Sidecar Management

On the Sidecar Management page, you can view information about all workloads injected with sidecars, perform sidecar injection, and configure sidecar resource limits.

Injecting a Sidecar

You can view the namespace and cluster to which the injected sidecar belongs. If no sidecar has been injected or you need to inject sidecar for more namespaces, perform the following operations:

Log in to the ASM console and click the target mesh to go to its details page.
In the navigation pane, choose Mesh Configuration. Click the Sidecar Management tab.
Click Inject Sidecar, select a namespace, determine whether to restart the existing services, and click OK.

Figure 1 Injecting a sidecar
- Namespace: Select one or more namespaces. The system labels the namespaces with istio-injection=enabled.
- Restart Existing Services
  : Pods of the existing services in the namespace will be restarted, which will temporarily interrupt your services. The istio-proxy sidecar is automatically injected into the pods of the existing services.
  
  : The istio-proxy sidecar cannot be automatically injected into the pods of the existing services. You need to manually restart the workloads on the CCE console to inject the sidecar. Whether to restart existing services affects only existing services. If the namespaces are labeled with istio-injection=enabled, sidecars will be automatically injected into new pods.
- If the system displays a message indicating that modification of namespace injection is not enabled in the following clusters, you need to run the kubectl command to enable namespace injection. For details, see How Do I Enable Namespace Injection for a Cluster.
- After sidecar injection is enabled for a namespace of a cluster, sidecars are automatically injected for pods of all workloads in the namespace. If you do not want to inject sidecars for some workloads, see How Do I Disable Sidecar Injection for Workloads?.
- For meshes of 1.8.4-r1 and earlier versions (including all 1.3 and 1.6 versions), you are advised to check whether the workload contains the annotation sidecar.istio.io/inject: 'true'. If not, add the annotation to the spec.template.metadata.annotations field:
```
      annotations:
        sidecar.istio.io/inject: 'true'
```

Viewing Workload Details

The list displays all workloads created in the clusters managed by a mesh. You can view the workload name, cluster to which the workload belongs, service, and sidecar information of the workload, including the sidecar name, version, status, CPU usage, and memory usage. The procedure is as follows:

In the drop-down list and search box in the upper right corner of the workload list, select a cluster and namespace, and enter the target workload name.
Click in front of the workload to view the sidecar information of the workload.
If the system displays a message indicating that there is no sidecar in the workload, no sidecar has been injected into the namespace to which the workload belongs. In this case, you can inject one into the namespace. For details, see Injecting a Sidecar.

Configuring Sidecar Resource Limits

You can configure the upper and lower limits of CPU and memory resources for sidecars (istio-proxy container). If the upper and lower resource limits are not set for a workload, a resource leak of this workload will make resources unavailable for other workloads deployed on the same node. In addition, workloads that do not have upper and lower resource limits cannot be accurately monitored.

The default upper and lower limits of sidecar resources are as follows:

CPU (core): 0.1 to 2 (included)
MEM (MiB): 128 to 1,024 (included)

To change the value, perform the following operations:

Click Set Resource Limit in the Operation column of the target workload. You can also select multiple workloads and click Set Resource Limit in the upper left corner of the workload list to configure sidecar resource limits in batches.

Figure 2 Setting resource limit
- Minimum CPU: CPU request, the minimum number of CPU cores required by a container. Resources are scheduled for the container based on this value. The container can be scheduled to a node only when the total available CPU on the node is greater than or equal to the number of CPU cores applied for the container.
- Maximum CPU: CPU limit, the maximum number of CPU cores required by a container.
- Minimum memory: memory request, the minimum amount of memory required by a container. Resources are scheduled for the container based on this value. The container can be scheduled to this node only when the total available memory on the node is greater than or equal to the requested container memory.
- Maximum memory: memory limit, the maximum amount of memory required by a container. When the memory usage exceeds the specified memory limit, the pod may be restarted, which affects the normal use of the workload.

Configuring Memory Alarm for Sidecar Resources

When the memory usage exceeds the specified memory limit, the pod may be restarted, which affects the normal use of the workload. Therefore, you are advised to configure memory alarm for all sidecar resources. After the alarm is triggered, you can increase the maximum memory size of the corresponding sidecar resource in a timely manner to reduce the impact on services.

Log in to the Application Operations Management (AOM) console.
In the navigation pane on the left, choose Alarm Center > Alarm Rules, and click Add Alarm in the upper right corner.
Set an alarm rule.
- Rule Name: Enter a rule name, for example, istio-proxy.
- Rule Type: Select Threshold rule.
- Monitored Object: Click Select resource objects, set Add by to Dimension, and select Cloud Service Metrics > CCE > Container > Physical memory usage for Metric Name.
  In the Dimension drop-down list, select Cluster ID, the ID of the cluster for which the alarm is enabled, Container name, and istio-proxy by sequence. Click Confirm.
  
  Figure 3 Selecting the monitored object
- Alarm Condition: Set information such as statistical periods, consecutive periods, and threshold condition.
  Figure 4 Setting alarm condition
- Alarm Mode: Select Direct Alarm Reporting.
Click Create Now.
If the following information is displayed in the rule list, the rule is created successfully.

Figure 5 Rule list
You can view the latest active alarm information and load details in the alarm list.
When the alarm is triggered, one or more records are added to the active alarm list. Click the alarm name. On the Alarm Object tab page, view parameters such as deploymentName and nameSpace to determine which sidecar resource is the alarm source. For details about how to modify the sidecar resource limits on the service plane, see Configuring Sidecar Resource Limits. The limits on the sidecar resources on the control plane, such as istio-ingressgateway, istio-egressgateway, and istio-eastwestgateway, need to be modified in upgrade mode on the Workloads page of the CCE console.

Figure 6 Alarm details