I have installed istio in my k8s cluster, and labeled my desired namespace with
istio-injection=enabled
However, when I install a pod, it doesn't inject the sidecar.
I followed the instructions on this page: https://istio.io/latest/docs/ops/common-problems/injection/#automatic-sidecar-injection-fails-if-the-kubernetes-api-server-has-proxy-settings
and I see that my webhook namespaceSelectors are incorrect:
$ kubectl get mutatingwebhookconfiguration istio-sidecar-injector -o yaml | grep "namespaceSelector:" -A5
namespaceSelector:
matchLabels:
istio.io/deactivated: never-match
objectSelector:
matchLabels:
istio.io/deactivated: never-match
--
namespaceSelector:
matchLabels:
istio.io/deactivated: never-match
objectSelector:
matchLabels:
istio.io/deactivated: never-match
--
namespaceSelector:
matchLabels:
istio.io/deactivated: never-match
objectSelector:
matchLabels:
istio.io/deactivated: never-match
--
namespaceSelector:
matchLabels:
istio.io/deactivated: never-match
objectSelector:
matchLabels:
istio.io/deactivated: never-match
According to that page, they should be:
namespaceSelector:
matchLabels:
istio-injection: enabled
rules:
- apiGroups:
- ""
Why are the webhook namespace selectors being installed incorrectly? I have wiped the installation and tried again, but after reinstallation the webhook selectors are always wrong.
How can I fix this?
