failureThreshold: 10
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: foo-nosidecar
spec:
  replicas: 1
  selector:
    matchLabels:
      app: foo
      version: nosidecar
  template:
    metadata:
      labels:
        app: foo
        version: nosidecar
        test.istio.io/class: naked
      annotations:
        prometheus.io/scrape: "true"

			sidecar:  "default/global",
			describe: "no match local sidecar",
		},
		{
			proxy:    &Proxy{Type: SidecarProxy, ConfigNamespace: "nosidecar"},
			labels:   labels.Instance{"app": "bar"},
			sidecar:  "nosidecar/global",
			describe: "no sidecar",
		},
		{
			proxy:    &Proxy{Type: Router, ConfigNamespace: "istio-system"},
			labels:   labels.Instance{"app": "istio-gateway"},

)

var _ echo.Sidecar = &sidecar{}

type sidecar struct {
	podNamespace string
	podName      string
	cluster      cluster.Cluster
}

func newSidecar(pod corev1.Pod, cluster cluster.Cluster) *sidecar {
	sidecar := &sidecar{
		podNamespace: pod.Namespace,
		podName:      pod.Name,
		cluster:      cluster,
	}

	return sidecar
}

package echo

import (
	admin "github.com/envoyproxy/go-control-plane/envoy/admin/v3"

	"istio.io/istio/pkg/test"
	"istio.io/istio/pkg/test/util/retry"
)

// Sidecar provides an interface to execute queries against a single Envoy sidecar.
type Sidecar interface {
	// Info about the Envoy instance.
	Info() (*admin.ServerInfo, error)
	InfoOrFail(t test.Failer) *admin.ServerInfo

	// Config of the Envoy instance.

type SidecarScope struct {
	Name string
	// This is the namespace where the sidecar takes effect,
	// maybe different from the ns where sidecar resides if sidecar is in root ns.
	Namespace string
	// The cr itself. Can be nil if we are constructing the default
	// sidecar scope
	Sidecar *networking.Sidecar

	// Version this sidecar was computed for
	Version string

rules:
  - apiGroups:
      - extensions
    resources:
      - podsecuritypolicies
    resourceNames:
      - istio-sidecar
    verbs:
      - use
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: istio-sidecar-psp
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: istio-sidecar-psp
subjects:
  - apiGroup: rbac.authorization.k8s.io

          {{ if or (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory`) -}}
          requests:
            {{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU`) -}}
            cpu: "{{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU` }}"
            {{ end}}
            {{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory`) -}}

apiVersion: networking.istio.io/v1alpha3
kind: Sidecar
metadata:
  name: no-selector # Since this is the only Sidecar in the namespace without a workload selector, no conflict
  namespace: ns1
spec:
  egress:
  - hosts:
    - "./*"
---
apiVersion: networking.istio.io/v1alpha3
kind: Sidecar
metadata:
  name: has-selector
  namespace: ns1
spec:

apiVersion: v1
kind: Pod
metadata:
  name: hello
spec:
  initContainers:
    - name: other-sidecar
      restartPolicy: Always
      readinessProbe:
        httpGet:
          port: 3333
      image: "fake.docker.io/google-samples/hello-go-gke:1.0"
      ports:
        - name: http
          containerPort: 80
  containers:
    - name: hello
      image: "fake.docker.io/google-samples/hello-go-gke:1.0"
      ports:

  - '[reference] https://istio.io/latest/docs/reference/config/networking/sidecar/#Sidecar-inbound_connection_pool'

releaseNotes:
  - |