Este contenido no está disponible en el idioma seleccionado.
Chapter 3. Sidecar injection
To use Istio’s capabilities within a service mesh, each pod needs a sidecar proxy, configured and managed by the Istio control plane.
3.1. About sidecar injection Copiar enlaceEnlace copiado en el portapapeles!
Sidecar injection is enabled using labels at the namespace or pod level. These labels also indicate the specific control plane managing the proxy. When you apply a valid injection label to the pod template defined in a deployment, any new pods created by that deployment automatically receive a sidecar. Similarly, applying a pod injection label at the namespace level ensures any new pods in that namespace include a sidecar.
Injection happens at pod creation through an admission controller, so changes appear on individual pods rather than the deployment resources. To confirm sidecar injection, check the pod details directly using oc describe
, where you can see the injected Istio proxy container.
3.2. Identifying the revision name Copiar enlaceEnlace copiado en el portapapeles!
The label required to enable sidecar injection is determined by the specific control plane instance, known as a revision. Each revision is managed by an IstioRevision
resource, which is automatically created and managed by the Istio
resource, so manual creation or modification of IstioRevision
resources is generally unnecessary.
The naming of an IstioRevision
depends on the spec.updateStrategy.type
setting in the Istio
resource. If set to InPlace
, the revision shares the Istio
resource name. If set to RevisionBased
, the revision name follows the format <Istio resource name>-v<version>
. Typically, each Istio
resource corresponds to a single IstioRevision
. However, during a revision-based upgrade, multiple IstioRevision
resources may exist, each representing a distinct control plane instance.
To see available revision names, use the following command:
oc get istiorevisions
$ oc get istiorevisions
You should see output similar to the following example:
Example output
NAME READY STATUS IN USE VERSION AGE my-mesh-v1-23-0 True Healthy False v1.23.0 114s
NAME READY STATUS IN USE VERSION AGE
my-mesh-v1-23-0 True Healthy False v1.23.0 114s
3.2.1. Enabling sidecar injection with default revision Copiar enlaceEnlace copiado en el portapapeles!
When the service mesh’s IstioRevision
name is default
, it’s possible to use the following labels on a namespace or a pod to enable sidecar injection:
Resource | Label | Enabled value | Disabled value |
---|---|---|---|
Namespace |
|
|
|
Pod |
|
|
|
You can also enable injection by setting the istio.io/rev: default
label in the namespace or pod.
3.2.2. Enabling sidecar injection with other revisions Copiar enlaceEnlace copiado en el portapapeles!
When the IstioRevision
name is not default
, use the specific IstioRevision
name with the istio.io/rev
label to map the pod to the desired control plane and enable sidecar injection. To enable injection, set the istio.io/rev: default
label in either the namespace or the pod, as adding it to both is not required.
For example, with the revision shown above, the following labels would enable sidecar injection:
Resource | Enabled label | Disabled label |
---|---|---|
Namespace |
|
|
Pod |
|
|
When both istio-injection
and istio.io/rev
labels are applied, the istio-injection
label takes precedence and treats the namespace as part of the default revision.
3.3. Enabling sidecar injection Copiar enlaceEnlace copiado en el portapapeles!
To demonstrate different approaches for configuring sidecar injection, the following procedures use the Bookinfo application.
Prerequisites
-
You have installed the Red Hat OpenShift Service Mesh Operator, created an
Istio
resource, and the Operator has deployed Istio. -
You have created the
IstioCNI
resource, and the Operator has deployed the necessaryIstioCNI
pods. - You have created the namespaces that are to be part of the mesh, and they are discoverable by the Istio control plane.
-
Optional: You have deployed the workloads to be included in the mesh. In the following examples, the Bookinfo has been deployed to the
bookinfo
namespace, but sidecar injection (step 5) has not been configured. For more information, see "Deploying the Bookinfo application".
3.3.1. Enabling sidecar injection with namespace labels Copiar enlaceEnlace copiado en el portapapeles!
In this example, all workloads within a namespace receive a sidecar proxy injection, making it the best approach when the majority of workloads in the namespace should be included in the mesh.
Procedure
Verify the revision name of the Istio control plane using the following command:
oc get istiorevisions
$ oc get istiorevisions
Copy to Clipboard Copied! Toggle word wrap Toggle overflow You should see output similar to the following example:
Example output
NAME TYPE READY STATUS IN USE VERSION AGE default Local True Healthy False v1.23.0 4m57s
NAME TYPE READY STATUS IN USE VERSION AGE default Local True Healthy False v1.23.0 4m57s
Copy to Clipboard Copied! Toggle word wrap Toggle overflow Since the revision name is default, you can use the default injection labels without referencing the exact revision name.
Verify that workloads already running in the desired namespace show
1/1
containers asREADY
by using the following command. This confirms that the pods are running without sidecars.oc get pods -n bookinfo
$ oc get pods -n bookinfo
Copy to Clipboard Copied! Toggle word wrap Toggle overflow You should see output similar to the following example:
Example output
Copy to Clipboard Copied! Toggle word wrap Toggle overflow To apply the injection label to the
bookinfo
namespace, run the following command at the CLI:oc label namespace bookinfo istio-injection=enabled
$ oc label namespace bookinfo istio-injection=enabled namespace/bookinfo labeled
Copy to Clipboard Copied! Toggle word wrap Toggle overflow To ensure sidecar injection is applied, redeploy the existing workloads in the
bookinfo
namespace. Use the following command to perform a rolling update of all workloads:oc -n bookinfo rollout restart deployments
$ oc -n bookinfo rollout restart deployments
Copy to Clipboard Copied! Toggle word wrap Toggle overflow
Verification
Verify the rollout by checking that the new pods display
2/2
containers asREADY
, confirming successful sidecar injection by running the following command:oc get pods -n bookinfo
$ oc get pods -n bookinfo
Copy to Clipboard Copied! Toggle word wrap Toggle overflow You should see output similar to the following example:
Example output
Copy to Clipboard Copied! Toggle word wrap Toggle overflow
3.3.2. Exclude a workload from the mesh Copiar enlaceEnlace copiado en el portapapeles!
You can exclude specific workloads from sidecar injection within a namespace where injection is enabled for all workloads.
This example is for demonstration purposes only. The bookinfo application requires all workloads to be part of the mesh for proper functionality.
Procedure
-
Open the application’s
Deployment
resource in an editor. In this case, exclude theratings-v1
service. Modify the
spec.template.metadata.labels
section of yourDeployment
resource to include the labelsidecar.istio.io/inject: false
to disable sidecar injection.Copy to Clipboard Copied! Toggle word wrap Toggle overflow NoteAdding the label to the top-level
labels
section of theDeployment
does not affect sidecar injection.Updating the deployment triggers a rollout, creating a new ReplicaSet with updated pod(s).
Verification
Verify that the updated pod(s) do not contain a sidecar container and show
1/1
containers asRunning
by running the following command:oc get pods -n bookinfo
$ oc get pods -n bookinfo
Copy to Clipboard Copied! Toggle word wrap Toggle overflow You should see output similar to the following example:
Example output
Copy to Clipboard Copied! Toggle word wrap Toggle overflow
3.3.3. Enabling sidecar injection with pod labels Copiar enlaceEnlace copiado en el portapapeles!
This approach allows you to include individual workloads for sidecar injection instead of applying it to all workloads within a namespace, making it ideal for scenarios where only a few workloads need to be part of a service mesh. This example also demonstrates the use of a revision label for sidecar injection, where the Istio
resource is created with the name my-mesh
. A unique Istio
resource name is required when multiple Istio control planes are present in the same cluster or during a revision-based control plane upgrade.
Procedure
Verify the revision name of the Istio control plane by running the following command:
oc get istiorevisions
$ oc get istiorevisions
Copy to Clipboard Copied! Toggle word wrap Toggle overflow You should see output similar to the following example:
Example output
NAME TYPE READY STATUS IN USE VERSION AGE my-mesh Local True Healthy False v1.23.0 47s
NAME TYPE READY STATUS IN USE VERSION AGE my-mesh Local True Healthy False v1.23.0 47s
Copy to Clipboard Copied! Toggle word wrap Toggle overflow Since the revision name is
my-mesh
, use the revision labelistio.io/rev=my-mesh
to enable sidecar injection.Verify that workloads already running show
1/1
containers asREADY
, indicating that the pods are running without sidecars by running the following command:oc get pods -n bookinfo
$ oc get pods -n bookinfo
Copy to Clipboard Copied! Toggle word wrap Toggle overflow You should see output similar to the following example:
Example output
Copy to Clipboard Copied! Toggle word wrap Toggle overflow -
Open the application’s
Deployment
resource in an editor. In this case, update theratings-v1
service. Update the
spec.template.metadata.labels
section of yourDeployment
to include the appropriate pod injection or revision label. In this case,istio.io/rev: my-mesh
:Copy to Clipboard Copied! Toggle word wrap Toggle overflow NoteAdding the label to the top-level
labels
section of theDeployment
resource does not impact sidecar injection.Updating the deployment triggers a rollout, creating a new ReplicaSet with the updated pod(s).
Verification
Verify that only the ratings-v1 pod now shows
2/2
containersREADY
, indicating that the sidecar has been successfully injected by running the following command:oc get pods -n bookinfo
$ oc get pods -n bookinfo
Copy to Clipboard Copied! Toggle word wrap Toggle overflow You should see output similar to the following example:
Example output
Copy to Clipboard Copied! Toggle word wrap Toggle overflow - Repeat for other workloads that you wish to include in the mesh.
3.4. Enabling sidecar injection with namespace labels and an IstioRevisionTag resource Copiar enlaceEnlace copiado en el portapapeles!
To use the istio-injection=enabled
label when your revision name is not default
, you must create an IstioRevisionTag
resource with the name default
that references your Istio
resource.
Prerequisites
-
You have installed the Red Hat OpenShift Service Mesh Operator, created an
Istio
resource, and the Operator has deployed Istio. -
You have created the
IstioCNI
resource, and the Operator has deployed the necessaryIstioCNI
pods. - You have created the namespaces that are to be part of the mesh, and they are discoverable by the Istio control plane.
-
Optional: You have deployed the workloads to be included in the mesh. In the following examples, the Bookinfo has been deployed to the
bookinfo
namespace, but sidecar injection (step 5 in "Deploying the Bookinfo application" procedure) has not been configured. For more information, see "Deploying the Bookinfo application".
Procedure
Find the name of your
Istio
resource by running the following command:oc get istio
$ oc get istio
Copy to Clipboard Copied! Toggle word wrap Toggle overflow Example output
NAME REVISIONS READY IN USE ACTIVE REVISION STATUS VERSION AGE default 1 1 1 default-v1-24-3 Healthy v1.24.3 11s
NAME REVISIONS READY IN USE ACTIVE REVISION STATUS VERSION AGE default 1 1 1 default-v1-24-3 Healthy v1.24.3 11s
Copy to Clipboard Copied! Toggle word wrap Toggle overflow In this example, the
Istio
resource has the namedefault
, but the underlying revision is calleddefault-v1-24-3
.Create the
IstioRevisionTag
resource in a YAML file:Example
IstioRevistionTag
resource YAML fileCopy to Clipboard Copied! Toggle word wrap Toggle overflow Apply the
IstioRevisionTag
resource by running the following command:oc apply -f istioRevisionTag.yaml
$ oc apply -f istioRevisionTag.yaml
Copy to Clipboard Copied! Toggle word wrap Toggle overflow Verify that the
IstioRevisionTag
resource has been created successfully by running the following command:oc get istiorevisiontags.sailoperator.io
$ oc get istiorevisiontags.sailoperator.io
Copy to Clipboard Copied! Toggle word wrap Toggle overflow Example output
NAME STATUS IN USE REVISION AGE default Healthy True default-v1-24-3 4m23s
NAME STATUS IN USE REVISION AGE default Healthy True default-v1-24-3 4m23s
Copy to Clipboard Copied! Toggle word wrap Toggle overflow In this example, the new tag is referencing your active revision,
default-v1-24-3
. Now you can use theistio-injection=enabled
label as if your revision was calleddefault
.Confirm that the pods are running without sidecars by running the following command. Any workloads that are already running in the desired namespace should show
1/1
containers in theREADY
column.oc get pods -n bookinfo
$ oc get pods -n bookinfo
Copy to Clipboard Copied! Toggle word wrap Toggle overflow Example output
Copy to Clipboard Copied! Toggle word wrap Toggle overflow Apply the injection label to the
bookinfo
namespace by running the following command:oc label namespace bookinfo istio-injection=enabled \ namespace/bookinfo labeled
$ oc label namespace bookinfo istio-injection=enabled \ namespace/bookinfo labeled
Copy to Clipboard Copied! Toggle word wrap Toggle overflow To ensure sidecar injection is applied, redeploy the workloads in the
bookinfo
namespace by running the following command:oc -n bookinfo rollout restart deployments
$ oc -n bookinfo rollout restart deployments
Copy to Clipboard Copied! Toggle word wrap Toggle overflow
Verification
Verify the rollout by running the following command and confirming that the new pods display
2/2
containers in theREADY
column:oc get pods -n bookinfo
$ oc get pods -n bookinfo
Copy to Clipboard Copied! Toggle word wrap Toggle overflow Example output
Copy to Clipboard Copied! Toggle word wrap Toggle overflow