Explain Istio's sidecar injection mechanism. How does the Envoy proxy intercept all traffic without application changes?
Quick Answer
Istio uses a MutatingAdmissionWebhook to inject an Envoy sidecar container and an init container (istio-init) into pods. The init container sets up iptables rules to redirect all inbound/outbound traffic through Envoy.
Detailed Answer
Injection Mechanism
1. MutatingAdmissionWebhook: When a pod is created, the Kubernetes API server calls Istio's webhook (istiod). The webhook modifies the pod spec to add: - istio-init init container: Runs iptables rules to redirect traffic - istio-proxy sidecar container: The Envoy proxy - Shared volumes for certificates and configuration
2. Traffic Interception (istio-init): - Redirects all inbound TCP traffic (except port 15xxx) to Envoy's inbound listener (port 15006) - Redirects all outbound TCP traffic to Envoy's outbound listener (port 15001) - Uses iptables -t nat -A OUTPUT -j ISTIO_REDIRECT rules - The application is completely unaware — it sends/receives traffic normally
3. Envoy Processing: - Inbound: Envoy terminates mTLS, applies authorization policies, then forwards to the app on localhost - Outbound: Envoy intercepts, applies routing rules (VirtualService), establishes mTLS to destination's Envoy, sends request
Ambient Mesh (Istio 1.22+)
New sidecar-less mode using per-node ztunnel proxy for L4 (mTLS) and optional waypoint proxies for L7 (routing, policies). Reduces resource overhead by ~50%.
Code Example
# Enable sidecar injection for a namespace
kubectl label namespace production istio-injection=enabled
# Check if sidecar is injected
kubectl get pod -n production -o jsonpath='{.items[*].spec.containers[*].name}'
# Should show: app-container istio-proxy
# View iptables rules set by istio-init
kubectl exec <pod> -c istio-proxy -- iptables -t nat -L -n -v
# Shows ISTIO_REDIRECT and ISTIO_OUTPUT chains
# Disable injection for specific pod
metadata:
annotations:
sidecar.istio.io/inject: "false"
# Resource limits for sidecar
metadata:
annotations:
sidecar.istio.io/proxyCPU: "100m"
sidecar.istio.io/proxyMemory: "128Mi"
sidecar.istio.io/proxyCPULimit: "500m"
sidecar.istio.io/proxyMemoryLimit: "256Mi"Interview Tip
Walk through the three components: webhook injection, iptables interception, and Envoy processing. Mention ambient mesh as the future direction — it shows you follow Istio's evolution.