Configuring Sidecar Resources

1. Configuring Sidecar Resource Limits

Resource	Configuration Key	Default Value	Description
cpu	`resources.limits.cpu`	`100m`	CPU limit for the sidecar container
memory	`resources.limits.memory`	`128Mi`	Memory limit for the sidecar container
ephemeral-storage	`resources.limits.ephemeral-storage`	`2Gi`	Ephemeral storage limit for the sidecar container

Example: Setting Resource Limits in Istio

apiVersion: v1
kind: Pod
metadata:
  name: my-app-pod
spec:
  containers:
  - name: app
    image: my-app-image
  - name: istio-proxy
    image: istio/proxyv2:latest
    resources:
      limits:
        cpu: "200m"
        memory: "256Mi"
        ephemeral-storage: "4Gi"

2. Setting Sidecar Resource Requests

Property	Description	Default Value	Notes
requests.cpu	CPU resource request for the sidecar container	`100m`	Minimum CPU allocation for sidecar
requests.memory	Memory resource request for the sidecar container	`128Mi`	Minimum memory allocation for sidecar

Example: Sidecar Resource Requests Configuration

apiVersion: v1
kind: Pod
metadata:
  name: app-with-sidecar
spec:
  containers:
  - name: app
    image: myapp:latest
  - name: sidecar
    image: istio/proxyv2:1.20.0
    resources:
      requests:
        cpu: 200m
        memory: 256Mi

3. Configuring Proxy Concurrency

Property	Description	Default Value	Notes
proxy.concurrency	Number of concurrent requests the proxy can handle	1024	Adjust based on expected traffic and resource constraints
proxy.max_connections	Maximum number of connections the proxy can manage	10000	Higher values may increase memory usage
proxy.max_pending_requests	Maximum pending requests before rejecting new ones	10000	Helps prevent resource exhaustion under high load

Example: Setting Proxy Concurrency Limits

proxy:
  concurrency: 2048
  max_connections: 15000
  max_pending_requests: 12000

Note: Increasing proxy concurrency can improve throughput but may also increase memory consumption and CPU usage. Monitor resource utilization after changes.

4. Setting Proxy Log Level

Log Level	Description	Usage
trace	Most verbose level, includes all internal operations and debugging info.	Use for detailed troubleshooting and development.
debug	Includes debug messages and trace-level details.	Use during development or when detailed logs are needed for diagnostics.
info	Default level, logs informational messages and major events.	Recommended for production environments to monitor service behavior.
warn	Logs warnings and errors only.	Use to focus on potential issues without excessive logging.
error	Logs only errors and critical issues.	Use in production for minimal logging overhead.

Example: Setting Log Level via Configuration

apiVersion: v1
kind: ConfigMap
metadata:
  name: istio-config
data:
  meshConfig: |
    proxy:
      logLevel: debug

Example: Setting Log Level via CLI

istioctl install --set values.meshConfig.proxy.logLevel=warn

5. Configuring Proxy Access Logs

Property	Description	Default Value	Notes
accessLog	Path to the access log file	`/dev/stdout`	Can be set to a file path or `/dev/stdout`
accessLogFormat	Format of the access log entries	`json`	Supports `json` and `text`
accessLogFields	Fields to include in the access log	All fields	Can be filtered using `include` or `exclude`

Example: Configuring Access Log Format

proxy:
  accessLog:
    format: json
    path: /var/log/proxy/access.log

Example: Customizing Access Log Fields

proxy:
  accessLog:
    fields:
      include:
        - startTime
        - method
        - path
        - responseCode

6. Setting Proxy Tracing Configuration

Configuration Option	Description	Default Value	Notes
tracing.enabled	Enables or disables tracing	`false`	Set to `true` to enable tracing
tracing.endpoint	Endpoint to send trace data	`/v1/trace`	Can be overridden to send to a custom collector
tracing.sampleRate	Percentage of requests to trace (0.0 to 1.0)	`0.1`	Set to `1.0` for 100% tracing
tracing.serviceName	Name of the service in trace data	`unknown-service`	Used for filtering and grouping in tracing systems

Example: Enabling Tracing in a Service Mesh

tracing:
  enabled: true
  endpoint: /v1/trace
  sampleRate: 0.5
  serviceName: "my-service"

Note: Tracing configuration is typically applied at the proxy level and can be overridden per service.

7. Configuring Proxy Statistics

Example: Enabling Stats for Envoy Proxy

apiVersion: v1
kind: ConfigMap
metadata:
  name: istio-config
data:
  envoyStats: |
    stats:
      - name: envoy.stats
        config:
          stats: true

Configuration Option	Description	Default Value	Notes
envoyStats	Enables or disables Envoy proxy statistics collection.	`false`	Set to `true` to enable stats.
statsd	Enables StatsD integration for proxy metrics.	`false`	Requires StatsD server configuration.
prometheus	Enables Prometheus metrics endpoint.	`false`	Exposes metrics at `/stats/prometheus`.

Note: Prometheus integration is preferred for modern observability setups.

Example: Prometheus Configuration

apiVersion: v1
kind: ConfigMap
metadata:
  name: prometheus-config
data:
  prometheus.yml: |
    global:
      scrape_interval: 15s
    scrape_configs:
    - job_name: 'istio-proxy'
      kubernetes_sd_configs:
      - role: pod
      relabel_configs:
      - source_labels: [__meta_kubernetes_pod_annotation_prometheus_io_scrape]
        action: keep
        regex: true

8. Excluding Ports from Interception

Port	Exclusion Status	Description
80	`excluded`	HTTP traffic, typically excluded to avoid sidecar interference
443	`excluded`	HTTPS traffic, often excluded for performance reasons
9090	`included`	Application metrics port, usually intercepted for observability

Example: Excluding Ports in Istio

apiVersion: v1
kind: Service
metadata:
  name: my-service
  annotations:
    traffic.sidecar.istio.io/excludeInboundPorts: "80,443"
spec:
  ports:
  - port: 80
    targetPort: 8080

Note: Excluding ports prevents the sidecar proxy from intercepting traffic on those ports, which is useful for services that require direct access or have specific security requirements.

9. Configuring Proxy Image and Version

Property	Values	Description
proxy.image	`istio/proxyv2:1.21.0`	Image name and tag for the sidecar proxy
proxy.imagePullPolicy	`IfNotPresent`, `Always`, `Never`	Policy for pulling the proxy image

Example: Setting Proxy Image and Version

apiVersion: install.istio.io/v1alpha1
kind: IstioOperator
metadata:
  name: istio-control-plane
spec:
  components:
    ingressGateways:
      - name: istio-ingressgateway
        enabled: true
  values:
    global:
      proxy:
        image: istio/proxyv2:1.21.0
        imagePullPolicy: IfNotPresent

Note: Ensure the proxy image version is compatible with your Istio control plane version.

10. Managing Proxy Lifecycle Hooks

Hook Type	Description	Usage	Notes
PRE_START	Executed before the proxy starts	`PRE_START` hook can be used to initialize environment or validate configurations.	Useful for setting up runtime dependencies
POST_START	Executed after the proxy starts successfully	`POST_START` hook can be used to register with service discovery or log startup success.	Can be used for health checks or telemetry setup
PRE_STOP	Executed before the proxy stops	`PRE_STOP` hook can be used to flush logs or clean up resources.	Ensures graceful shutdown of proxy services
POST_STOP	Executed after the proxy stops	`POST_STOP` hook can be used to notify external systems or perform cleanup tasks.	Used for finalization and reporting

Example: Configuring Lifecycle Hooks in Istio

apiVersion: v1
kind: ConfigMap
metadata:
  name: proxy-config
data:
  lifecycleHooks: |
    preStart:
      exec:
        command: ["/bin/sh", "-c", "echo 'Initializing proxy...'"]
    postStart:
      exec:
        command: ["/bin/sh", "-c", "echo 'Proxy started successfully'"]
    preStop:
      exec:
        command: ["/bin/sh", "-c", "echo 'Shutting down proxy...'"]
    postStop:
      exec:
        command: ["/bin/sh", "-c", "echo 'Proxy shutdown complete'"]

Note: Lifecycle hooks are defined in the proxy configuration and must be compatible with the container runtime environment.

11. Configuring Proxy Environment Variables

Variable	Description	Default Value	Notes
ISTIO_METAJSON	JSON string containing metadata to be injected into the proxy	""	Used for customizing proxy behavior with metadata
PROXY_CONFIG	Configuration for the proxy, including resource limits and timeouts	""	Allows overriding default proxy settings
ISTIO_META_PROXY_CONFIG	Proxy configuration in JSON format	""	Used to pass proxy-specific configurations
ISTIO_META_POD_NAME	Name of the pod where the proxy is running	""	Used for logging and observability
ISTIO_META_NAMESPACE	Namespace of the pod where the proxy is running	""	Used for filtering and routing rules
ISTIO_META_SERVICE_ACCOUNT	Service account used by the pod	""	Used for authentication and authorization

Example: Setting Environment Variables in Deployment

apiVersion: apps/v1
kind: Deployment
metadata:
  name: my-app
spec:
  template:
    spec:
      containers:
      - name: app
        image: my-app:latest
        env:
        - name: ISTIO_METAJSON
          value: '{"customKey": "customValue"}'
        - name: PROXY_CONFIG
          value: '{"connectTimeout": "5s", "idleTimeout": "30s"}'

12. Setting Proxy Drain Duration

Property	Value	Description
proxy.drainDuration	`45s`	Duration to wait before shutting down the proxy after a drain event.

Example: Configuring drain duration in a service mesh

apiVersion: v1
kind: Service
metadata:
  name: example-service
spec:
  selector:
    app: example-app
  ports:
  - port: 80
    targetPort: 8080
---
apiVersion: networking.istio.io/v1beta1
kind: DestinationRule
metadata:
  name: example-destination-rule
spec:
  host: example-service
  trafficPolicy:
    connectionPool:
      http:
        idleTimeout: 30s
    outlierDetection:
      consecutiveErrors: 5
    proxy:
      drainDuration: 45s