Envoy sidecar

Learn the Envoy sidecar proxy.

The Envoy sidecar

Injection adds two things to each pod: an init container (istio-init or the CNI plugin) sets the pod's iptables rules so all incoming and outgoing traffic goes to Envoy; and the istio-proxy container runs Envoy. The application still thinks it connects to http://db:5432; in reality the connection goes through the local Envoy.

$ kubectl get pod api-6b5c4d3e2-abcde -n magaza -o jsonpath='{.spec.containers[*].name}'
api istio-proxy
$ kubectl logs api-6b5c4d3e2-abcde -n magaza -c istio-proxy --tail=2
[2026-11-03T10:12:01Z] "GET /urunler HTTP/1.1" 200 - via_upstream - "-" 0 4821 12 11 "-" "curl/8.10" "…" "api:8000"

Sidecar resources and exclusion

Each sidecar uses memory and CPU; across hundreds of pods this total matters. Resources are set with annotations; some pods (e.g. Jobs) can be excluded from injection:

  template:
    metadata:
      annotations:
        sidecar.istio.io/proxyCPU: "50m"
        sidecar.istio.io/proxyMemory: "64Mi"
      labels:
        sidecar.istio.io/inject: "false"     # this pod is outside the mesh

Exercise Inspect the sidecar

Write two commands: print the container names of the api-6b5c4d3e2-abcde pod in magaza with jsonpath='{.spec.containers[*].name}'; show the last 5 log lines of the same pod's istio-proxy container.

Show example solution

kubectl get pod api-6b5c4d3e2-abcde -n magaza -o jsonpath='{.spec.containers[*].name}'
kubectl logs api-6b5c4d3e2-abcde -n magaza -c istio-proxy --tail=5

Test yourself

Does the application code need to change for the mesh?
- No; traffic is transparently redirected to the proxy with iptables
- Yes, the Envoy library must be added
- Only in Go applications
- Only the ports change
Show answer

No; traffic is transparently redirected to the proxy with iptables — A little application support may still be needed to forward tracing headers.

Exclude this pod from injection.

      labels:
        sidecar.istio.io/inject: ____

Show answer

      labels:
        sidecar.istio.io/inject: "false"

Match.

istio-init

iptables rules
istio-proxy

Envoy container
proxyMemory

Sidecar memory setting
inject: "false"

Outside the mesh

Next lesson: Traffic management

We Are Enhancing Your Experience

Cookie Preferences

Strictly Necessary Cookies

Analytical Cookies