Automatic sidecar injection adds a proxy container beside each newly created workload Pod through Kubernetes admission, enabling transparent participation in Anthos Service Mesh. section 4.5.1
Configure injection at the namespace and workload lifecycle levels:
- Enable injection by labeling the application namespace with the appropriate Anthos Service Mesh revision, such as istio.io/rev=asm-managed. section 4.5.1 section 4.7.1
- Let the mutating admission webhook apply the injection configuration; the istio-sidecar-injector configuration map controls the injected proxy. section 4.5.1
- Restart existing Pods after labeling because injection occurs only when Pods are created. section 4.5.1
- Verify successful injection by checking that each workload reports two ready containers: the application and its proxy. section 4.5.1
Enable injection for an Online Boutique namespace
Create the demo namespace, inspect istiod labels to identify the control-plane revision, label the namespace with that revision, and deploy the application. The resulting workload Pods report 2/2 READY, confirming proxy injection. section 4.7.1
kubectl label namespace NAMESPACE istio.io/rev=asm-managed --overwrite
Use the supplied kubectl command to label a namespace for the asm-managed injection revision, then restart deployments and inspect Pod readiness. section 4.5.1
