Working with Sidecar CRD

1. Understanding Sidecar Resource Scope

Property	Description	Values	Notes
metadata.name	Name of the Sidecar resource	`sidecar-1`	Must be unique within the namespace
metadata.namespace	Namespace where the Sidecar is defined	`default`	Used to scope the Sidecar to a specific namespace
spec.workloads	List of workloads to which the Sidecar applies	`[{name: "app-1", namespace: "default"}]`	Each workload must be defined in the same namespace
spec.ports	Ports to be included in the Sidecar	`[{number: 8080, name: "http"}]`	Can include multiple ports with different names
spec.trafficPolicy	Configuration for traffic handling within the Sidecar	`{connectionPool: {http: {maxRequestsPerConnection: 10}}}`	Allows fine-grained control over traffic behavior

Example: Sidecar Resource Definition

apiVersion: networking.istio.io/v1beta1
kind: Sidecar
metadata:
  name: sidecar-1
  namespace: default
spec:
  workloads:
    - name: app-1
      namespace: default
  ports:
    - number: 8080
      name: http
  trafficPolicy:
    connectionPool:
      http:
        maxRequestsPerConnection: 10

Note: The Sidecar resource is used to define how traffic flows through a service mesh, particularly for workloads that are not part of the mesh by default.

2. Configuring Workload Selectors

Property	Description	Example
workloadSelector	Defines the selector to identify workloads to which the sidecar applies	`{ "labels": { "app": "frontend" } }`
workloadSelector.labels	Map of label key-value pairs to match workloads	`{ "app": "frontend", "version": "v1" }`
workloadSelector.namespace	Namespace to scope the selector to	`{ "namespace": "production" }`

Example: Selecting Workloads by Label

apiVersion: networking.istio.io/v1beta1
kind: Sidecar
metadata:
  name: default-sidecar
spec:
  workloadSelector:
    labels:
      app: frontend

Example: Selecting Workloads by Namespace

apiVersion: networking.istio.io/v1beta1
kind: Sidecar
metadata:
  name: namespace-sidecar
spec:
  workloadSelector:
    namespace: production

3. Setting Egress Listeners

Property	Description	Values	Notes
egress.hosts	Specifies the hosts to which egress traffic is allowed	`string[]`	Supports wildcard patterns like `*.example.com`
egress.port	Port number for egress traffic	`int`	Defaults to 80 for HTTP, 443 for HTTPS
egress.protocol	Protocol used for egress traffic	`HTTP \| HTTPS \| GRPC \| TCP \| TLS`	Must match the service protocol

Example: Configure Egress Listener

apiVersion: networking.istio.io/v1beta1
kind: Sidecar
metadata:
  name: egress-sidecar
spec:
  egress:
  - hosts:
    - "*.googleapis.com"
    port:
      number: 443
      protocol: HTTPS

4. Configuring Ingress Listeners

Property	Description	Values	Notes
host	Hostname for the ingress listener	`example.com`	Must match the domain name of the service
port	Port to listen on for incoming traffic	`80`, `443`	Commonly 80 for HTTP and 443 for HTTPS
tls	Enables TLS termination for the listener	`true`, `false`	Set to true for HTTPS traffic
gateway	Gateway to bind the listener to	`mesh-gateway`	Must reference a valid gateway in the mesh

Example: Ingress Listener Configuration

apiVersion: networking.istio.io/v1beta1
kind: IngressListener
metadata:
  name: example-ingress
spec:
  host: example.com
  port: 443
  tls: true
  gateway: mesh-gateway

5. Implementing Sidecar Resource Optimization

Resource Type	Description	Optimization Strategy	Notes
Sidecar	Defines the configuration for a sidecar proxy in a service mesh	Minimize resource limits and requests to reduce overhead	Use minimal CPU and memory settings for sidecar proxies
Proxy Resources	Resource limits and requests for the sidecar proxy (e.g., Envoy)	Set appropriate limits to prevent resource contention	Typically use `500m` CPU and `512Mi` memory
Traffic Policies	Configuration for traffic routing and load balancing in the sidecar	Optimize policies to reduce latency and improve throughput	Use `localityLbSetting` for better distribution

Example: Sidecar Resource Configuration

apiVersion: networking.istio.io/v1beta1
kind: Sidecar
metadata:
  name: default-sidecar
spec:
  workloadSelector:
    labels:
      app: frontend
  egress:
  - port:
      number: 80
      protocol: HTTP
    hosts:
    - &#34;*.example.com&#34;
  ingress:
  - port:
      number: 8080
      protocol: HTTP
    bind: &#34;127.0.0.1&#34;
    defaultEndpoint: &#34;127.0.0.1:8080&#34;

Example: Resource Limits for Sidecar Proxy

apiVersion: v1
kind: Pod
metadata:
  name: frontend-pod
spec:
  containers:
  - name: frontend
    image: frontend-image
  - name: istio-proxy
    image: istio/proxyv2:1.20.0
    resources:
      limits:
        cpu: 500m
        memory: 512Mi
      requests:
        cpu: 100m
        memory: 128Mi

Note: Ensure that the sidecar resource configuration aligns with the overall service mesh resource constraints to avoid over-allocation.

6. Configuring Discovery Selectors

Property	Description	Values	Notes
discoverySelectors	Defines how the sidecar discovers and connects to services	`object[]`	Array of discovery selector objects

Example: Discovery Selectors Configuration

discoverySelectors:
  - matchLabels:
      app: frontend
    matchExpressions:
      - key: version
        operator: In
        values: [v1, v2]

Note: Discovery selectors are used to define how the sidecar identifies and connects to services in the mesh. These selectors can match labels or expressions to determine which services should be included.

7. Setting Sidecar Metrics Configuration

Property	Values	Description
metrics.prometheus.enabled	`true` \| `false`	Enables or disables Prometheus metrics collection.
metrics.prometheus.port	`9090`	Port on which Prometheus metrics are exposed.
metrics.prometheus.path	`/metrics`	Endpoint path for Prometheus metrics.
metrics.prometheus.scrapeInterval	`15s`	How often to scrape metrics (default 15 seconds).
metrics.prometheus.timeout	`10s`	Timeout for scraping metrics (default 10 seconds).

Example: Prometheus Metrics Configuration

apiVersion: networking.istio.io/v1beta1
kind: Sidecar
metadata:
  name: default-sidecar
spec:
  metrics:
    prometheus:
      enabled: true
      port: 9090
      path: /metrics
      scrapeInterval: 15s
      timeout: 10s

8. Managing Sidecar Outbound Traffic Policy

Policy	Description	Values	Notes
outboundTrafficPolicy.mode	Controls how outbound traffic is handled	`ALLOW_ANY`, `REGISTRY_ONLY`	Default is `ALLOW_ANY` if not set
outboundTrafficPolicy.exceptedIPs	IP ranges to exclude from traffic policy	List of CIDR blocks	Used when `ALLOW_ANY` is set
outboundTrafficPolicy.exceptedPorts	Ports to exclude from traffic policy	List of port numbers	Used when `ALLOW_ANY` is set

Example: Configuring Outbound Traffic Policy

apiVersion: networking.istio.io/v1beta1
kind: Sidecar
metadata:
  name: default-sidecar
spec:
  outboundTrafficPolicy:
    mode: ALLOW_ANY
    exceptedIPs:
      - 10.0.0.0/8
      - 172.16.0.0/12
    exceptedPorts:
      - 80
      - 443

Note: Setting outboundTrafficPolicy.mode to REGISTRY_ONLY restricts traffic to only services registered in the service registry.

9. Configuring Capture Mode

Mode	Description	Configuration	Notes
capture.mode	Defines how traffic is captured by the sidecar proxy	`redirect`, `direct`	Default is `redirect`
capture.mode.redirect	Redirects traffic through the sidecar using iptables rules	`true` or `false`	Requires root privileges for iptables setup
capture.mode.direct	Directly intercepts traffic without iptables rules	`true` or `false`	May require additional network configuration

Example: Redirect Mode Configuration

apiVersion: v1
kind: Service
metadata:
  name: my-service
  annotations:
    sidecar.istio.io/captureMode: redirect
spec:
  selector:
    app: my-app
  ports:
  - port: 80
    targetPort: 8080

Example: Direct Mode Configuration

apiVersion: v1
kind: Service
metadata:
  name: my-service
  annotations:
    sidecar.istio.io/captureMode: direct
spec:
  selector:
    app: my-app
  ports:
  - port: 80
    targetPort: 8080

Note: The redirect mode is more commonly used and supported across most environments. The direct mode requires specific support from the underlying platform and may not be available in all deployments.

10. Troubleshooting Sidecar Configuration

Issue	Potential Cause	Solution
Sidecar not injected	Missing or incorrect annotations on pod	Verify `sidecar.istio.io/inject` annotation is set to `true`
Sidecar fails to start	Invalid configuration in `ProxyConfig`	Check `istioctl proxy-config` for errors in sidecar logs
Traffic not routing through sidecar	Incorrect `DestinationRule` or `VirtualService`	Validate that traffic policies are correctly applied to the service
High CPU/memory usage by sidecar	Too many services or complex routing rules	Optimize `DestinationRule` and `VirtualService` configurations

Example: Check Sidecar Injection Status

istioctl proxy-config bootstrap <pod-name> -n <namespace>

Example: Validate Sidecar Logs

kubectl logs <pod-name> -n <namespace> -c istio-proxy

Note: Use istioctl analyze to detect misconfigurations in your service mesh.

Warning: Misconfigured sidecars can lead to service outages or security vulnerabilities.

11. Implementing Sidecar Scope Limitations

Property	Description	Values	Notes
scope	Defines the scope of the Sidecar resource	`cluster`, `namespace`	Controls where the Sidecar is applied
workloadSelector	Selector to identify workloads to apply the Sidecar to	`{ labels: { ... } }`	Allows scoping by workload labels
config	Configuration for the sidecar proxy	`{ ... }`	Includes network and traffic settings

Example: Sidecar with namespace scope

apiVersion: networking.istio.io/v1beta1
kind: Sidecar
metadata:
  name: default-sidecar
  namespace: production
spec:
  scope: namespace
  workloadSelector:
    labels:
      app: frontend
  config:
    egress:
    - port:
        number: 80
        protocol: HTTP
      hosts:
      - "*.example.com"

Note: The scope field determines whether the Sidecar is applied cluster-wide or only within a specific namespace.

Warning: Misconfiguring the workloadSelector can lead to unintended sidecar injection or exclusion.

12. Managing Sidecar Precedence

Precedence Level	Description	Scope	Example
Global	Applies to all services in the mesh	Mesh-wide configuration	`sidecar.global.precedence: "high"`
Namespace	Applies to services within a namespace	Namespace-level configuration	`sidecar.namespace.precedence: "medium"`
Service	Applies to a specific service instance	Per-service configuration	`sidecar.service.precedence: "low"`

Example: Setting Sidecar Precedence in a Service

apiVersion: networking.istio.io/v1beta1
kind: Sidecar
metadata:
  name: custom-sidecar
  namespace: production
spec:
  workloadSelector:
    labels:
      app: frontend
  config:
    precedence: "high"
    ingress:
    - port:
        number: 80
        name: http
        protocol: HTTP
      bind: 127.0.0.1

Note: Precedence levels are evaluated in order: Global > Namespace > Service. Higher precedence values override lower ones.