11.MD

Task 11: Manual Sidecar Injection

Step 1: Switch to Correct Context

kubectl config use-context cluster3-admin@cluster3

Step 2: Check Current State

# Check if namespace has injection label
kubectl get namespace indigo --show-labels

# Check existing pods
kubectl get pods -n indigo

# The sleep-indigo pod should be running without sidecar (1/1)

Step 3: Manual Injection Using istioctl kube-inject

# Get the current pod definition
kubectl get pod sleep-indigo -n indigo -o yaml > /tmp/sleep-indigo.yaml

# Delete the existing pod
kubectl delete pod sleep-indigo -n indigo --force

# Inject sidecar using istioctl and apply
istioctl kube-inject -f /tmp/sleep-indigo.yaml | kubectl apply -f -

Alternative: One-liner approach

kubectl get pod sleep-indigo -n indigo -o yaml | istioctl kube-inject -f - | kubectl replace --force -f -

Step 4: Verify the Injection

# Check that the pod has 2 containers (app + istio-proxy)
kubectl get pod sleep-indigo -n indigo

# Should show 2/2 READY
# Example output:
# NAME           READY   STATUS    RESTARTS   AGE
# sleep-indigo   2/2     Running   0          30s

# Verify containers
kubectl get pod sleep-indigo -n indigo -o jsonpath='{.spec.containers[*].name}'
# Should show: sleep-indigo istio-proxy

# Check init containers (istio adds init container too)
kubectl get pod sleep-indigo -n indigo -o jsonpath='{.spec.initContainers[*].name}'
# Should show: istio-init

# Describe pod to see full details
kubectl describe pod sleep-indigo -n indigo

Step 5: Verify Namespace Is Not Modified

# Verify the namespace doesn't have injection label
kubectl get namespace indigo -o jsonpath='{.metadata.labels}'

# The output should NOT contain: istio-injection: enabled
# Manual injection via istioctl doesn't require namespace label

Testing

Test 1: Verify Container Count

# Count containers
CONTAINER_COUNT=$(kubectl get pod sleep-indigo -n indigo -o jsonpath='{.spec.containers[*].name}' | wc -w)
echo "Container count: $CONTAINER_COUNT"

# Should be 2 (sleep-indigo + istio-proxy)

Test 2: Verify Sidecar Annotations

# Check for Istio annotations added by kube-inject
kubectl get pod sleep-indigo -n indigo -o jsonpath='{.metadata.annotations}' | grep istio

# Should see annotations like:
# - sidecar.istio.io/status
# - kubectl.kubernetes.io/restartedAt

Test 3: Verify Istio Proxy Container

# Check if istio-proxy container exists
kubectl get pod sleep-indigo -n indigo -o jsonpath='{.spec.containers[?(@.name=="istio-proxy")].name}'

# Should output: istio-proxy