Transparent proxy injection into existing K8s clusters

[andraxylia]

• Initial initializer deployment and configuration is merged into istio/pilot. Additional enhancements are pending review (Additional sidecar injection enhancements #1104).
• The feature is disabled by default in in e2e presubmit tests but can be enabled with -use-initializer flag to bin/e2e.sh. The feature will by enabled by default in istio/pilot after Additional sidecar injection enhancements #1104 is merged. The initializer is cluster scoped so any bugs could affect the entire test cluster. We should be prepared to revert to default-off and manually delete the initializer configuration. ClusterPool testing feature will help here (cc @sebastienvas). The feature can be enabled in istio/istio after istio/pilot switch over is complete.

TODO

• Merge enhancement PR Additional sidecar injection enhancements #1104
• Update istio/istio template files for initializer deployment/configuration
• Document injection method for istio.io document automatic injection #1046

Automated sidecar injection
By leveraging the alpha initializer feature provided by Kubernetes 1.7, envoy sidecars can now be automatically injected into application deployments when your cluster has the initializer enabled. This enables you to deploy microservices using kubectl, the exact same command that you normally use for deploying the microservices without Istio.

[kyessenov]

Please reference the upstream issue from Kubernetes. We might get it for 1.7.

[andraxylia]

Depends on kubernetes/community#132

[andraxylia]

I opened this issue, hopefully we can enhance PodPreset and re-use functionality:
kubernetes/kubernetes#43874

[ldemailly]

doc is https://docs.google.com/document/d/1-5rLhv6MbB27lL8l2CWD6kR-eMa13_PPwOScVVZq8bo/

[kyessenov]

There are two aspects of proxy injection: inserting a sidecar and programming iptables. Rephrased the title to be about the first item.

[ldemailly]

this is an epic so maybe it should cover both ?

[andraxylia]

Yes, it's an epic and covers everything. You can open issues and group them under this epic.

[andraxylia]

The title matches the roadmap item, let's leave it as it is.

[ldemailly]

epic should not be closed yet

[andraxylia]

This is done. P1 enhancements are possible, but they will need to be prioritized.

[Promaethius]

What's the status on this? Istios documentation says it's not ready but all the pull requests and issues are merged and closed respectively.

[ldemailly]

@Promaethius can you provide a link to where it says it's not ready ?

[Promaethius]

https://github.com/istio/pilot/blob/master/doc/proxy-injection.md
https://istio.io/docs/reference/commands/istioctl.html#istioctl-kube-inject

[kyessenov]

Issue moved to istio/istio #1365 via ZenHub