<p>I want to add envoy proxy to an existing Kubernetes deployment as a sidecar. I tried following multiple blog posts and that did not seem to help. I was wondering if anyone has done it, and if so, how to?</p>

<p>Thank you!</p>

Parvathy Geetha
<p>To add <a href="https://stackoverflow.com/a/51777604/476917">Kun Li's anwer</a>, if your case is the kubernetes cluster already has many services running, it is safer to do that by set the <code>autoInjection</code> policy as <code>disabled</code> by default, and let the service owner set it explicitly that it wants to use istio side car.</p>

<p>To do that, you have to:</p>

<ul>
<li>set the Istio (via helm installation) helm installation flag <code>--global.proxy.autoInject=disabled --sidecarInjectorWebhook.enabled=true</code>. </li>
<li>then in your namespace, set <code>kubectl label namespace bar istio-injection=enabled</code></li>
</ul>

<p>The <code>--sidecarInjectorWebhook.enabled=true</code> and labeling your namespace: means that the istio sidecar injector webhook is activated for your namespace. But then, since you specify the <code>global.proxy.autoInject=disabled</code>, it won't inject any pods. So, the service owner have to define explicitly the pod's annotation (in your deployment yaml file) like below:</p>

<pre><code>  template:
    metadata:
      annotations:
        sidecar.istio.io/inject: "true"
</code></pre>

<p>To check your istio's sidecar injection policy, </p>

<blockquote>
  <p>kubectl get cm istio-sidecar-injector -n istio-system -o yaml</p>
</blockquote>

<p>take a look at <code>data.config</code> value, it should contains <code>policy: disable</code> or <code>policy: enabled</code>.</p>

<p>Reference:
- <a href="https://istio.io/docs/setup/kubernetes/sidecar-injection/#policy" rel="nofollow noreferrer">https://istio.io/docs/setup/kubernetes/sidecar-injection/#policy</a>
- personal hands on (I've tried it)</p>
