How Do I Enable Namespace Injection for a Cluster?

When injecting a sidecar to the namespace of a cluster, if the namespace injection is not enabled in the cluster, perform the following steps:

1. Connect to the cluster using kubectl.
2. Run the kubectl get iop -nistio-system command to query iop resources.
   • If the following information is displayed, the iop resource exists. Go to 3.

     

   • If the following information is displayed, no iop resources exist. Go to 4.

     

3. Run the kubectl edit iop -nistio-system data-plane command to modify the autoInject configuration item. In the preceding command, data-plane indicates the name of the iop resource queried in the previous step. Replace it with the actual value.

       global:
         defaultPodDisruptionBudget:
           enabled: true
         hub: *.*.*.*:20202/asm
         logging:
           level: default:info
         meshID: test-payment
         multiCluster:
           clusterName: test-yy
         network: test-yy-network
         proxy:
           autoInject: enabled
         remotePilotAddress: *.*.*.*
         tag: 1.8.6-r1-20220512225026

   

   Perform the following operations only in Istio 1.18.7-r4 or later.

   After running the kubectl edit iop command to edit the parameter to be modified, change the value of install.istio.io/ignoreReconcile to false, save the modification, and exit.

   

   Run the kubectl get iop -n istio-system command to check the IOP status. Wait until the value of STATUS changes to HEALTHY.

   

   Change the value of install.istio.io/ignoreReconcile to true.

4. Run the kubectl edit cm -nistio-system istio-sidecar-injector command to modify the istio-sidecar-injector configuration item.

   data:
     config: |-
       policy: enabled