Automatic Sidecar Injection

Automatic sidecar injection adds the sidecar proxy into user-createdpods. It uses a MutatingWebhook to append the sidecar’s containersand volumes to each pod’s template spec during creationtime. Injection can be scoped to particular sets of namespaces usingthe webhooks namespaceSelector mechanism. Injection can also beenabled and disabled per-pod with an annotation.

Whether or not a sidecar is injected depends on three pieces of configuration and two security rules:

Configuration:

• webhooks namespaceSelector
• default policy
• per-pod override annotation

Security rules:

• sidecars cannot be injected in the kube-system or kube-public namespaces
• sidecars cannot be injected into pods that use the host network

The following truth table shows the final injection status based onthe three configuration items. The security rules above cannot be overridden.