<p>I have Kubernetes 1.9.3 cluster and deployed Istio 1.0.12 on it. Create a namespace with istio-injection=enabled and created a deployment in that namespace. I don't see envoy proxy getting automatically injected into the pods created by deployments.</p>

<p>Istio calls kube-apiserver to inject envoy proxy into the pods. Two plugins need to be enabled in kube-apiserver for proxy injection to work. </p>

<p>kube-apiserver runs as a static pod and the pod manifest is available at <code>/etc/kubernetes/manifests/kube-apiserver.yaml</code>. Update the line as shown below to include <code>MutatingAdmissionWebhook</code> and <code>ValidatingAdmissionWebhook</code> plugins (available since Kubernetes 1.9).</p>

<pre><code>- --admission-control=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota
</code></pre>

<p>The kubelet will detect the changes and re-create kube-apiserver pod automatically.</p>
