Envoy sidecar
- Docker & Kubernetes course
- Expert
- Lesson 21/47
- 4 min
Learn the Envoy sidecar proxy.
The Envoy sidecar
Injection adds two things to each pod: an init container (istio-init or the CNI plugin) sets the pod's iptables rules so all incoming and outgoing traffic goes to Envoy; and the istio-proxy container runs Envoy. The application still thinks it connects to http://db:5432; in reality the connection goes through the local Envoy.
$ kubectl get pod api-6b5c4d3e2-abcde -n magaza -o jsonpath='{.spec.containers[*].name}'
api istio-proxy
$ kubectl logs api-6b5c4d3e2-abcde -n magaza -c istio-proxy --tail=2
[2026-11-03T10:12:01Z] "GET /urunler HTTP/1.1" 200 - via_upstream - "-" 0 4821 12 11 "-" "curl/8.10" "…" "api:8000"Sidecar resources and exclusion
Each sidecar uses memory and CPU; across hundreds of pods this total matters. Resources are set with annotations; some pods (e.g. Jobs) can be excluded from injection:
template:
metadata:
annotations:
sidecar.istio.io/proxyCPU: "50m"
sidecar.istio.io/proxyMemory: "64Mi"
labels:
sidecar.istio.io/inject: "false" # this pod is outside the meshPractice Inspect the sidecar
Write two commands: print the container names of the api-6b5c4d3e2-abcde pod in magaza with jsonpath='{.spec.containers[*].name}'; show the last 5 log lines of the same pod's istio-proxy container.
Starter code
# buraya yazSample solution
kubectl get pod api-6b5c4d3e2-abcde -n magaza -o jsonpath='{.spec.containers[*].name}'
kubectl logs api-6b5c4d3e2-abcde -n magaza -c istio-proxy --tail=5Expected output
api istio-proxy [2026-11-03T10:12:01Z] "GET /urunler HTTP/1.1" 200 - via_upstream - "-" 0 4821 12 11 [2026-11-03T10:12:02Z] "GET /saglik HTTP/1.1" 200 - via_upstream - "-" 0 15 1 1
Questions and answers
Review the lesson questions together with their answers. To test yourself, solve the lesson interactively.
1 Does the application code need to change for the mesh?
- No; traffic is transparently redirected to the proxy with iptables Correct answer
- Yes, the Envoy library must be added
- Only in Go applications
- Only the ports change
Explanation: A little application support may still be needed to forward tracing headers.
2 Exclude this pod from injection.
labels:
sidecar.istio.io/inject: ____ labels:
sidecar.istio.io/inject: "false"Explanation: The value is written as the string "false".
3 Match.
| Term | Meaning |
|---|---|
istio-init |
iptables rules |
istio-proxy |
Envoy container |
proxyMemory |
Sidecar memory setting |
inject: "false" |
Outside the mesh |