Proxy Injector — Automatic Sidecar Injection Flow

Proxy Injector — Automatic Sidecar Injection Flow A sequence diagram generated by Archify. Pod create request Admission Review check injection conditions inspects linkerd.io/inject annotation on Namespace/Pod add linkerd-proxy sidecar container add linkerd-init init container, iptables rules set volumes / env vars identity token, proxy config Mutated Pod Spec Original Pod Spec returned unchanged, no injection create Pod ALT [injection enabled] — linkerd.io/inject: enabled ELSE [injection disabled] — linkerd.io/inject: disabled kubectl · Pod create request · Sequence participant kubectl Pod create request API Server · calls admission webhook · Sequence participant API Server calls admission webhook Proxy Injector · Mutating Webhook · Sequence participant Proxy Injector Mutating Webhook Pod Spec · requested Pod manifest · Sequence participant Pod Spec requested Pod manifest Pod · with sidecar · Sequence participant Pod with sidecar Legend request return security default message