I see that it is not required to label the istio-system namespace for injection, however, I seem to vaguely remember this being a step that was previously included during installation/configuration docs. Is there any particular benefits of doing this?
I don’t recall istio-system ever being advised for auto-injection, just default or whatever namespace you want to join your project.
That said, the Istio components in istio-system all have sidecar.istio.io/inject set to false so they don’t get injected even if it is enabled. I tried enabling it and deploying bookinfo into the same namespace and auto-injection worked on those pods and I was able to access it through the ingress gateway. So it seems to work, but I don’t think there’s any advantage to enabling it on istio-system.
2 Likes