<p>I have scenario where I need to inject istio-side into the workload without labelling the namespace. Reason I can't label the namespace is because in my cluster the namespace are created via an automated process and currently I can't change that process due to security reason. Hence want to understand if there is a way to automatically inject the istio sidecar into the workload without labelling the namespace.</p>
<p>Resources I have already tried and tested.</p>
<ol>
<li><p>Using the <code>sidecar.istio.io/inject=&quot;true&quot;</code> annotation on the in the deployment/pod definition.
<code>Note: the annotation will only work with if the namespace is labelled and for this reason I really don't why do we even have this annotation. For more information please visit: https://github.com/istio/istio/issues/6476#issuecomment-1023817004</code></p>
</li>
<li><p>Manual injection works but it has way too much operational overhead and hence is not a preferred method.</p>
</li>
<li><p>DiscoverySelector construct as only works on namespaces not on deployment/pods object inside kubernetes.</p>
</li>
</ol>
<p>Istio Version</p>
<pre><code>client version: 1.12.2
control plane version: 1.12.1
</code></pre>

Kunal Malhotra
<p>The issue described above is resolved.</p>
<p>The way to achieve the above is to use <code>sidecar.istio.io/inject=&quot;true&quot;</code> as <code>label</code> in pod/deployment definition, not as a <code>annotation</code>.</p>
<p>The correct definition of should look like this</p>
<pre><code>apiVersion: v1
kind: Pod
metadata:
  name: labeled-true
  namespace: policy-disabled
  labels:
    sidecar.istio.io/inject: &quot;true&quot;
spec:
  containers:
  - image: docker.io/citizenstig/httpbin
    imagePullPolicy: IfNotPresent
    name: httpbin
</code></pre>
<p>Not like this</p>
<pre><code>apiVersion: v1
kind: Pod
metadata:
  name: labeled-true
  namespace: policy-disabled
  annotations:
    sidecar.istio.io/inject: &quot;true&quot;
spec:
  containers:
  - image: docker.io/citizenstig/httpbin
    imagePullPolicy: IfNotPresent
    name: httpbin
</code></pre>
