The template Istio uses to inject a Sidecar lives in the istio-sidecar-injector ConfigMap. Annotations let you customize the Sidecar’s various parameters, such as CPU usage, proxyImage, and so on. What follows is mainly a summary of the Sidecar injection methods.

1. Add a label to a namespace -> takes effect for the whole namespace

• Inject the label

1

kubectl label namespace default istio-injection=enabled --overwrite

After the application restarts, the Sidecar container will be injected automatically. At this point, traffic will be forwarded to the service through envoy, which you can verify by inspecting the response headers.

• Remove the label

1

kubectl label namespace default istio-injection-

2. Add a label to a Pod -> takes effect for a single workload

• Inject the label

1

kubectl patch deployments blog -p '{"spec":{"template":{"metadata":{"labels":{"sidecar.istio.io/inject":"true"}}}}}' --type merge

The Pod will restart automatically.

• Remove the label

1

kubectl patch deployments blog -p '{"spec":{"template":{"metadata":{"labels":{"sidecar.istio.io/inject":""}}}}}' --type merge

sidecar.istio.io/inject set to false means injection is refused, so here it needs to be set to empty.

3. Inject with istioctl kube-inject -> takes effect for the specified workload

• dry-run just to look

1

istioctl kube-inject -f deployment.yaml -o deployment-injected.yaml

Or

1

kubectl get deployment blog -o yaml | istioctl kube-inject -f -

• Inject into a new workload

1

istioctl kube-inject -f deployment.yaml | kubectl apply -f -

• Inject into an existing workload

1

kubectl get deployment blog -o yaml | istioctl kube-inject -f - | kubectl apply -f -