failureThreshold: 10
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: foo-nosidecar
spec:
  replicas: 1
  selector:
    matchLabels:
      app: foo
      version: nosidecar
  template:
    metadata:
      labels:
        app: foo
        version: nosidecar
        test.istio.io/class: naked
      annotations:
        prometheus.io/scrape: "true"

			sidecar:  "default/global",
			describe: "no match local sidecar",
		},
		{
			proxy:    &Proxy{Type: SidecarProxy, ConfigNamespace: "nosidecar"},
			labels:   labels.Instance{"app": "bar"},
			sidecar:  "nosidecar/global",
			describe: "no sidecar",
		},
		{
			proxy:    &Proxy{Type: Router, ConfigNamespace: "istio-system"},
			labels:   labels.Instance{"app": "istio-gateway"},

)

var _ echo.Sidecar = &sidecar{}

type sidecar struct {
	podNamespace string
	podName      string
	cluster      cluster.Cluster
}

func newSidecar(pod corev1.Pod, cluster cluster.Cluster) *sidecar {
	sidecar := &sidecar{
		podNamespace: pod.Namespace,
		podName:      pod.Name,
		cluster:      cluster,
	}

	return sidecar
}

package echo

import (
	admin "github.com/envoyproxy/go-control-plane/envoy/admin/v3"

	"istio.io/istio/pkg/test"
	"istio.io/istio/pkg/test/util/retry"
)

// Sidecar provides an interface to execute queries against a single Envoy sidecar.
type Sidecar interface {
	// Info about the Envoy instance.
	Info() (*admin.ServerInfo, error)
	InfoOrFail(t test.Failer) *admin.ServerInfo

	// Config of the Envoy instance.

type SidecarScope struct {
	Name string
	// This is the namespace where the sidecar takes effect,
	// maybe different from the ns where sidecar resides if sidecar is in root ns.
	Namespace string
	// The cr itself. Can be nil if we are constructing the default
	// sidecar scope
	Sidecar *networking.Sidecar

	// Version this sidecar was computed for
	Version string

# Environment variables used to configure istio startup

# Comma separated list of CIDRs used for services. If set, iptables will be run to allow istio
# sidecar to intercept outbound calls to configured addresses. If not set, outbound istio sidecar
# will not be used via iptables.
# ISTIO_SERVICE_CIDR=

# Name of the service exposed by the machine.
# ISTIO_SERVICE=myservice

# The mode used to redirect inbound connections to Envoy. This setting

---
apiVersion: networking.istio.io/v1alpha3
kind: Sidecar
metadata:
  name: maps-correctly-no-conflicts
  namespace: default
spec:
  workloadSelector:
    labels:
      app: productpage # Maps to an existing workload without conflicts in the same ns, no error
  egress:
  - hosts:
    - "./*"
---
apiVersion: networking.istio.io/v1alpha3
kind: Sidecar
metadata:
  name: maps-to-nonexistent
  namespace: default

rules:
  - apiGroups:
      - extensions
    resources:
      - podsecuritypolicies
    resourceNames:
      - istio-sidecar
    verbs:
      - use
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: istio-sidecar-psp
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: istio-sidecar-psp
subjects:
  - apiGroup: rbac.authorization.k8s.io

          {{ if or (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory`) -}}
          requests:
            {{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU`) -}}
            cpu: "{{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU` }}"
            {{ end}}
            {{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory`) -}}

apiVersion: networking.istio.io/v1alpha3
kind: Sidecar
metadata:
  name: no-selector # Since this is the only Sidecar in the namespace without a workload selector, no conflict
  namespace: ns1
spec:
  egress:
  - hosts:
    - "./*"
---
apiVersion: networking.istio.io/v1alpha3
kind: Sidecar
metadata:
  name: has-selector
  namespace: ns1
spec: