K
Q

Istio 1.0 does not inject envoy proxy to pods on Kubernetes 1.9.3

11/28/2018

I have Kubernetes 1.9.3 cluster and deployed Istio 1.0.12 on it. Create a namespace with istio-injection=enabled and created a deployment in that namespace. I don't see envoy proxy getting automatically injected into the pods created by deployments.

-- randhir singh
istio
kubernetes

Similar Questions

Share data from one Kubernetes container to another inside same pod
what should be the max allowed image size for micro services on kubernetes
elasticsearch failed to resolve host [elasticsearch-discovery]
Unable to lock the lock file: /data/db/mongod.lock. Another mongod instance is already running on the /data/db directory, terminating
Nginx-ingress helm deployment - default backend only works with port 8080

1 Answer

11/28/2018

Istio calls kube-apiserver to inject envoy proxy into the pods. Two plugins need to be enabled in kube-apiserver for proxy injection to work.

kube-apiserver runs as a static pod and the pod manifest is available at /etc/kubernetes/manifests/kube-apiserver.yaml. Update the line as shown below to include MutatingAdmissionWebhook and ValidatingAdmissionWebhook plugins (available since Kubernetes 1.9).

- --admission-control=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota

The kubelet will detect the changes and re-create kube-apiserver pod automatically.

-- randhir singh
Source: StackOverflow