Support native sidecar by default by irenezhong2861 · Pull Request #56428 · istio/istio

irenezhong2861 · 2025-05-27T17:46:12Z

Please provide a description of this PR:
Enables native sidecar by default

linux-foundation-easycla · 2025-05-27T17:46:16Z

The committers listed above are authorized under a signed CLA.

✅ login: irenezhong2861 (b96d9db, 36db6f2, 3b6c0f7, a2d4432, 074d976, 686c5db, a5a3e9c, 0958d43, d0f09c7, c2f94c5, 080ef9b, 0682a93, e00ae4e, 76daf96, 334dc8b, 280230a, c3c6105, d7a1bc0, 5b06487, 7507f6a, 3dffc2f)
✅ login: sschepens (722177d)

istio-policy-bot · 2025-05-27T17:46:16Z

😊 Welcome @irenezhong2861! This is either your first contribution to the Istio istio repo, or it's been
a while since you've been here.

You can learn more about the Istio working groups, Code of Conduct, and contribution guidelines
by referring to Contributing to Istio.

Thanks for contributing!

Courtesy of your friendly welcome wagon.

istio-testing · 2025-05-27T17:46:23Z

Hi @irenezhong2861. Thanks for your PR.

I'm waiting for a istio member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

jaellio · 2025-05-27T19:22:42Z

/ok-to-test

manifests/charts/istio-control/istio-discovery/files/injection-template.yaml

keithmattix · 2025-05-28T18:07:20Z

manifests/charts/istio-control/istio-discovery/files/injection-template.yaml

-{{ $nativeSidecar := (or (and (not (isset .ObjectMeta.Annotations `sidecar.istio.io/nativeSidecar`)) (eq (env "ENABLE_NATIVE_SIDECARS" "false") "true")) (eq (index .ObjectMeta.Annotations `sidecar.istio.io/nativeSidecar`) "true")) }}
+{{ $nativeSidecar := .NativeSidecars }}
+{{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/nativeSidecar`) }}
+  {{ $nativeSidecar = eq (index .ObjectMeta.Annotations `sidecar.istio.io/nativeSidecar`) "true" }}


Why is this duplicated in the injection template logic?

Cleaned up this line. The injection-template is ran here, with params.nativeSidecar being passed in and read in injection-template.yaml via .NativeSidecars. The is to generate the template pod. Later on, the same annotation logic is used to generate the merged pod. Both places need code to overwrite the param.nativeSidecar value with the annotation value.

keithmattix · 2025-05-28T18:09:38Z

pkg/kube/inject/inject_test.go

+				Name: "node-1",
+			},
+			Status: corev1.NodeStatus{
+				NodeInfo: corev1.NodeSystemInfo{


Can we get more of a range of kubelet versions?

What about old kubelet versions? We should probably test that they have classic sidecars right?

added test case below with old version and added golden files. The new test case has one 1.33 node and one 1.28 node so native sidecar will be off without needing to set any flags.

pilot/pkg/features/experimental.go

keithmattix · 2025-05-28T18:14:02Z

pkg/kube/inject/webhook.go

 	}
+
+	var nodes kclient.Client[*corev1.Node]
+	if wh.nodes != nil {


Should probably log or something if this isn't initialized for some reason

pkg/kube/inject/webhook.go

keithmattix · 2025-05-28T18:18:03Z

pkg/kube/inject/webhook.go

+
+	minVersion := 29
+	allNodesValid := false
+	for _, n := range nodes.List(metav1.NamespaceAll, klabels.Everything()) {


What happens if someone adds an older node to their k8s cluster? Talk through the process in a code comment.

add comment around how older nodes will switch the native sidecar value to false since this checks versions of all nodes.

howardjohn

this needs to take into account Kubernetes version of wait until the minimum supported version is GA. this would be about 3 years so a long wait.

If you look through the issue you'll see I had a WIP PR to do so that we could leverage.

edit: I skimmed quickly on my phone and I think I missed some logic, so I may be wrong - will look closer soon. Sorry!

howardjohn · 2025-05-28T18:23:41Z

pkg/kube/inject/webhook.go

+		return false
+	}
+
+	minVersion := 29


should do 1.33 imo. we cannot GA a beta feature

+1 to this - I missed it in my initial pass. There is also a bug in older versions that doesn't really affect Istio, but still shouldn't expose users to it by default if we can help it IMO

in my initial PR I had a way for a user to say "automatically detect, minimum beta" as an opt-in to 1.29. but for default should be 1.33 IMO

if the pod has a node name assigned explicitly (very rare) we can also probably check only that node. maybe niche though

Updated the version to 1.33, with a branch to check if only the corresponding node if pod.Spec.nodeName is not empty. Currently have a log.warn if the the node name is set but the node can't be found, and not enabling native sidecar in that case, open to suggestions!

With this kubelet version check though, I don't think we need to wait until 1.33 is the min supported k8s version. It handles the case of nodes on ineligible versions by not defaulting native side cars for them. We might not need a check like this at all once 1.33 is the min version and just enable all by default.

Yes, once we get past the supported 1.33 version skew, we could remove a lot of these checks, though folks who are running LTS in a cloud provider need to keep them around

keithmattix · 2025-05-30T21:45:28Z

pkg/kube/inject/inject_test.go

+				Name: "node-1",
+			},
+			Status: corev1.NodeStatus{
+				NodeInfo: corev1.NodeSystemInfo{


What about old kubelet versions? We should probably test that they have classic sidecars right?

pkg/kube/inject/webhook.go

irenezhong2861 · 2025-06-05T16:46:53Z

/test integ-ambient-mc

* remove finding of pods by IP * fix test * add feature flag and release note

stale

howardjohn

As a fast followup, can we make sure we turn this off in the compatbility profiles for the older versions?

irenezhong2861 · 2025-07-08T17:02:34Z

As a fast followup, can we make sure we turn this off in the compatbility profiles for the older versions?

opened #56903 to update compatibility profiles

keithmattix · 2025-07-08T17:59:22Z

/cherry-pick release-1.27

istio-testing · 2025-07-08T18:00:06Z

@keithmattix: new pull request created: #56918

Details

In response to this:

/cherry-pick release-1.27

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

* upstream/master: set VERSION on master to 1.28 (istio#56902) Automator: update ztunnel@master in istio/istio@master (istio#56900) Move Alpha Gateway API Inference Extension support to master (istio#56845) Support native sidecar by default (istio#56428) feat: represent revision tags using services (istio#56851)

irenezhong2861 requested review from a team as code owners May 27, 2025 17:46

istio-testing added the size/XXL Denotes a PR that changes 1000+ lines, ignoring generated files. label May 27, 2025

istio-testing added the needs-ok-to-test label May 27, 2025

istio-testing added ok-to-test Set this label allow normal testing to take place for a PR not submitted by an Istio org member. and removed needs-ok-to-test labels May 27, 2025

irenezhong2861 force-pushed the irenezhong/default-native-sidecar branch 2 times, most recently from 8d311f3 to 08c79ad Compare May 27, 2025 19:34

irenezhong2861 requested a review from a team as a code owner May 27, 2025 19:34

irenezhong2861 requested a review from a team May 27, 2025 19:34

irenezhong2861 requested review from a team, costinm, howardjohn, hzxuzhonghu, keithmattix, linsun and stevenctl as code owners May 27, 2025 19:34

irenezhong2861 force-pushed the irenezhong/default-native-sidecar branch 2 times, most recently from aa7d148 to d39664b Compare May 27, 2025 19:45

keithmattix reviewed May 28, 2025

View reviewed changes

howardjohn requested changes May 28, 2025

View reviewed changes

howardjohn reviewed May 28, 2025

View reviewed changes

keithmattix reviewed May 30, 2025

View reviewed changes

irenezhong2861 force-pushed the irenezhong/default-native-sidecar branch from b3cc938 to 74b4cce Compare June 5, 2025 00:41

irenezhong2861 and others added 19 commits July 7, 2025 16:51

release notes

36db6f2

fix test

074d976

update golden file

a5a3e9c

comments and updates

d0f09c7

lint

c2f94c5

update testcases

a2d4432

lint

686c5db

lint

334dc8b

remove finding of pods by IP (istio#56502)

722177d

* remove finding of pods by IP * fix test * add feature flag and release note

comments and updates

0958d43

update testcases

3dffc2f

update native sidecar default value and related comment updates

e00ae4e

update feature file

080ef9b

update golden files

d7a1bc0

update golden files for openshift

7507f6a

update openshift golden files

c3c6105

update golden file

5b06487

update default settings

280230a

lint

76daf96

irenezhong2861 force-pushed the irenezhong/default-native-sidecar branch from a383473 to 76daf96 Compare July 7, 2025 19:50

istio-testing removed the needs-rebase Indicates a PR needs to be rebased before being merged label Jul 7, 2025

howardjohn approved these changes Jul 7, 2025

View reviewed changes

istio-testing merged commit da90b35 into istio:master Jul 7, 2025
30 checks passed

keithmattix added the cherrypick/release-1.27 Set this label on a PR to auto-merge it to the release-1.27 branch label Jul 8, 2025

istio-testing mentioned this pull request Jul 8, 2025

[release-1.27] Support native sidecar by default #56918

Merged

Conversation

irenezhong2861 commented May 27, 2025 • edited by istio-policy-bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

linux-foundation-easycla bot commented May 27, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

istio-policy-bot commented May 27, 2025

Uh oh!

istio-testing commented May 27, 2025

Uh oh!

jaellio commented May 27, 2025

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

howardjohn left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

keithmattix Jun 6, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

irenezhong2861 commented Jun 5, 2025

Uh oh!

howardjohn left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

irenezhong2861 commented Jul 8, 2025

Uh oh!

keithmattix commented Jul 8, 2025

Uh oh!

istio-testing commented Jul 8, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

7 participants

irenezhong2861 commented May 27, 2025 •

edited by istio-policy-bot

Loading

linux-foundation-easycla bot commented May 27, 2025 •

edited

Loading

howardjohn left a comment •

edited

Loading

keithmattix Jun 6, 2025 •

edited

Loading