Skip to main content
Version: 0.9.x

WorkloadEntry Annotations

List of annotations on a WorkloadEntry resource supported by the tctl x sidecar-bootstrap command.

Usage example​

apiVersion: networking.istio.io/v1beta1
kind: WorkloadEntry
metadata:
  name: my-vm
  namespace: my-namespace
  annotations:
    sidecar-bootstrap.istio.io/ssh-user: istio-proxy
    sidecar-bootstrap.istio.io/proxy-config-dir: /etc/istio-proxy
    sidecar-bootstrap.istio.io/proxy-instance-ip: 10.0.0.1

    sidecar.istio.io/logLevel: debug
    sidecar.istio.io/componentLogLevel: upstream:info,config:trace
    sidecar.istio.io/statsInclusionRegexps: .* # enable all Envoy metrics
    proxy.istio.io/config: |
      concurrency: 3
spec:
  ...

Standard Istio annotations​

proxy.istio.io/config​

Overrides for the proxy configuration for this specific proxy. Available options can be found at https://istio.io/docs/reference/config/istio.mesh.v1alpha1/#ProxyConfig.

sidecar.istio.io/interceptionMode​

Specifies the mode used to redirect inbound connections to Envoy (REDIRECT or TPROXY).

sidecar.istio.io/proxyImage​

Specifies the Docker image to be used by the Envoy sidecar.

sidecar.istio.io/logLevel​

Specifies the log level for Envoy.

sidecar.istio.io/componentLogLevel​

Specifies the component log level for Envoy.

sidecar.istio.io/statsInclusionPrefixes​

Specifies the comma separated list of prefixes of the stats to be emitted by Envoy.

sidecar.istio.io/statsInclusionSuffixes​

Specifies the comma separated list of suffixes of the stats to be emitted by Envoy.

sidecar.istio.io/statsInclusionRegexps​

Specifies the comma separated list of regexes the stats should match to be emitted by Envoy.

Annotations specific to tctl x sidecar-bootstrap command​

sidecar-bootstrap.istio.io/k8s-ca-root-cert-configmap​

Name of the Kubernetes config map that holds root certs of a k8s CA and, if applicable, OpenShift Service CA.

ConfigMap should include the following keys:

  • ca.crt - (mandatory) root certs of a k8s CA
  • service-ca.crt - (optional) root certs of an OpenShift Service CA

By default, config map is considered undefined and thus the only way to find out the root certs of a k8s CA and, if applicable, OpenShift Service CA is 1) either to read a k8s Secret with a ServiceAccountToken, which among other things holds the root certs of a k8s CA and, if applicable, OpenShift Service CA 2) or to read the root certs of a k8s CA from the /var/run/secrets/kubernetes.io/serviceaccount/ca.crt file, which is auto-mounted into Pods by k8s, and, if applicable, root certs of an OpenShift Service CA from the /var/run/secrets/kubernetes.io/serviceaccount/service-ca.crt

sidecar-bootstrap.istio.io/mesh-expansion-configmap​

Name of the Kubernetes config map that holds configuration intended for those Istio Proxies that expand the mesh.

ConfigMap should include the following keys:

This configuration is applied on top of mesh-wide default ProxyConfig, but prior to the workload-specific ProxyConfig from proxy.istio.io/config annotation on a WorkloadEntry.

By default, config map is considered undefined and thus expansion proxies will have the same configuration as the regular ones.

sidecar-bootstrap.istio.io/ssh-host​

IP address or DNS name of the machine represented by this WorkloadEntry to use instead of WorkloadEntry.Address for SSH connections initiated by the sidecar-bootstrap command.

This setting is intended for those scenarios where sidecar-bootstrap command will be run on a machine without direct connectivity to the WorkloadEntry.Address. E.g., one might set WorkloadEntry.Address to the Internal IP of a VM and set value of this annotation to the External IP of that VM.

By default, value of WorkloadEntry.Address is assumed.

sidecar-bootstrap.istio.io/ssh-port​

Port of the SSH server on the machine represented by this WorkloadEntry to use for SSH connections initiated by the sidecar-bootstrap command.

By default, "22" is assumed.

sidecar-bootstrap.istio.io/ssh-user​

User on the machine represented by this WorkloadEntry to use for SSH connections initiated by the sidecar-bootstrap command.

Make sure that user has enough permissions to create the config dir and to run Docker container without sudo.

By default, a user running sidecar-bootstrap command is assumed.

sidecar-bootstrap.istio.io/scp-path​

Path to the scp binary on the machine represented by this WorkloadEntry to use in SSH connections initiated by the sidecar-bootstrap command.

By default, "/usr/bin/scp" is assumed.

sidecar-bootstrap.istio.io/proxy-config-dir​

Directory on the machine represented by this WorkloadEntry where sidecar-bootstrap command should copy bootstrap bundle to.

By default, "/tmp/istio-proxy" is assumed (the most reliable default value for out-of-the-box experience).

sidecar-bootstrap.istio.io/proxy-image-hub​

Hub with Istio Proxy images that the machine represented by this WorkloadEntry should pull from instead of the mesh-wide hub.

By default, mesh-wide hub is assumed.

sidecar-bootstrap.istio.io/proxy-container-name​

Name for a container with Istio Proxy.

If you need to run multiple Istio Proxy containers on the same machine, make sure each of them has a unique name.

By default, "istio-proxy" is assumed.

sidecar-bootstrap.istio.io/proxy-instance-ip​

IP address of the machine represented by this WorkloadEntry that Istio Proxy should bind inbound listeners to.

This setting is intended for those scenarios where Istio Proxy cannot bind to the IP address specified in the WorkloadEntry.Address (e.g., on AWS EC2 where a VM can only bind the private IP but not the public one).

By default, WorkloadEntry.Address is assumed.