All Pods Have Sidecars Injected

Description

An istio-proxy container must exist in all pods of a Service. Otherwise, this item is abnormal.

Rectification Guide

1. Log in to the ASM console and click the name of the service mesh that the Service is added to. Choose Mesh Configuration in the navigation pane, click the Sidecar Management tab, and check whether a sidecar is injected into the namespace that the Service belongs to.
   • If no, go to 2.
   • If yes, go to 3.

2. Inject a sidecar.

   You can inject sidecars for pods of all workloads in the namespace. For details, see Injecting a Sidecar. You can also inject sidecars for a workload as follows:

   1. Label the namespace where the workload is located with istio-injection=enabled.

      kubectl label ns <namespace> istio-injection=enabled

   2. Add the annotations field for the workload on the CCE console.

            annotations:
              sidecar.istio.io/inject: 'true'

      

   For more details about sidecar injection, see Installing the Sidecar.

3. If namespace injection is enabled for the cluster but no sidecar is injected into the pod, you need to manually restart the pod on the CCE console as follows:

   On the CCE console, choose More > Redeploy in the Operation column of the target workload.

4. Check whether the host network mode is configured for the workload as follows:

   On the CCE console, choose More > Edit YAML in the Operation column of the target workload, and check whether spec.template.spec.hostNetwork: true is configured. If yes, check whether this field can be deleted or set to false. Otherwise, sidecars cannot be injected.

   

5. Check whether the number of pods exceeds the service mesh scale.

   If the number exceeds 200, the excess pods cannot be injected with sidecars.