Alauda Service Mesh v2 Docs

Identifying the revision name

The label required to enable sidecar injection is determined by the specific control plane instance, known as a revision. Each revision is managed by corresponding IstioRevision resource, which is automatically managed by the Istio resource.

The naming convention for an IstioRevision is based on the spec.updateStrategy.type setting in the Istio resource:

  • InPlace: The revision shares the same name as the parent Istio resource.
  • RevisionBased: The revision is named using the format <istio-resource-name>-v<version>.

Typically, each Istio resource corresponds to a single IstioRevision. However, during a revision-based upgrade, multiple IstioRevision resources may exist, each representing a distinct control plane.

To list available revisions, use the following command:

kubectl get istiorevisions

For example output:

NAME              NAMESPACE      PROFILE   READY   STATUS    IN USE   VERSION   AGE
default-v1-26-3   istio-system             True    Healthy   False    v1.26.3   40s

TOC

Enabling sidecar injection with default revision

When the name of IstioRevision is default, you can use the following labels on a namespace or a pod to enable sidecar injection:

ResourceEnabled labelDisalbed label
Namespaceistio-injection=enabledistio-injection=disabled
Podsidecar.istio.io/inject=truesidecar.istio.io/inject=false
NOTE

You can also enable injection by applying the istio.io/rev: default label to the namespace or pod.

Enabling sidecar injection with other revisions

When then name of IstioRevision is not default, you'll need to use the specific IstioRevision name with the istio.io/rev label. This links the pod to the desired control plane and enables sidecar injection.

For instance, using the example revision default-v1-26-3 from above, the following labels would enable sidecar injection:

ResourceEnabled labelDisabled label
Namespaceistio.io/rev=default-v1-26-3istio-injection=disabled
Podistio.io/rev=default-v1-26-3sidecar.istio.io/inject=false
NOTE

When both istio-injection and istio.io/rev labels are applied, the istio-injection label takes precedence and treats the namespace as part of the default revision.

The injector is configured with the following logic:

  1. If either label (istio-injection or sidecar.istio.io/inject) is disabled, the pod is not injected.
  2. If either label (istio-injection or sidecar.istio.io/inject or istio.io/rev) is enabled, the pod is injected.