istio · vrushalijoshi · Jun 16, 2025
@@ -182,6 +182,13 @@ var (
 	EnableNativeSidecars = env.Register("ENABLE_NATIVE_SIDECARS", false,
 		"If set, used Kubernetes native Sidecar container support. Requires SidecarContainer feature flag.")
 
+	// InitContainerBeforeProxy is an environment variable that specifies a list of containers
+	// (as a comma-separated string) to be started before the istio-proxy container.
+	// This feature is used when the native sidecar is enabled and applies to all workloads,
+	// not just specific workloads.
+	InitContainerBeforeProxy = env.Register("INIT_CONTAINERS_BEFORE_PROXY", "",
+		"If set, the containers listed, as comma seperated value, will be started before the istio-proxy container. This feature is used when native sidecar is enabled")
+
 	Enable100ContinueHeaders = env.Register("ENABLE_100_CONTINUE_HEADERS", true,
 		"If enabled, istiod will proxy 100-continue headers as is").Get()
 

@@ -350,6 +350,14 @@ func TestInjection(t *testing.T) {
 				test.SetEnvForTest(t, features.EnableNativeSidecars.Name, "true")
 			},
 		},
+		{
+			in:   "native-sidecar-order-override.yaml",
+			want: "native-sidecar-order-override.yaml.injected",
+			setup: func(t test.Failer) {
+				test.SetEnvForTest(t, features.EnableNativeSidecars.Name, "true")
+				test.SetEnvForTest(t, features.InitContainerBeforeProxy.Name, "override-sidecar")
+			},
+		},
 		{
 			in:   "native-sidecar-opt-in.yaml",
 			want: "native-sidecar-opt-in.yaml.injected",

@@ -0,0 +1,33 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: hello
+  annotations:
+    "sidecar.istio.io/init-containers-before-proxy": "other-sidecar"
+spec:
+  initContainers:
+    - name: other-sidecar
+      restartPolicy: Always
+      readinessProbe:
+        httpGet:
+          port: 3333
+      image: "fake.docker.io/google-samples/hello-go-gke:1.0"
+      ports:
+        - name: http
+          containerPort: 80
+    - name: override-sidecar
+      restartPolicy: Always
+      readinessProbe:
+        httpGet:
+          port: 3333
+      image: "fake.docker.io/google-samples/hello-go-gke:1.0"
+      ports:
+        - name: http
+          containerPort: 80
+  containers:
+    - name: hello
+      image: "fake.docker.io/google-samples/hello-go-gke:1.0"
+      ports:
+        - name: http
+          containerPort: 80
+
@@ -0,0 +1,266 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  annotations:
+    istio.io/rev: default
+    kubectl.kubernetes.io/default-container: hello
+    kubectl.kubernetes.io/default-logs-container: hello
+    prometheus.io/path: /stats/prometheus
+    prometheus.io/port: "15020"
+    prometheus.io/scrape: "true"
+    sidecar.istio.io/init-containers-before-proxy: other-sidecar
+    sidecar.istio.io/status: '{"initContainers":["istio-init","istio-proxy"],"containers":null,"volumes":["workload-socket","credential-socket","workload-certs","istio-envoy","istio-data","istio-podinfo","istio-token","istiod-ca-cert","istio-ca-crl"],"imagePullSecrets":null,"revision":"default"}'
+  creationTimestamp: null
+  labels:
+    security.istio.io/tlsMode: istio
+    service.istio.io/canonical-name: hello
+    service.istio.io/canonical-revision: latest
+  name: hello
+spec:
+  containers:
+  - image: fake.docker.io/google-samples/hello-go-gke:1.0
+    name: hello
+    ports:
+    - containerPort: 80
+      name: http
+    resources: {}
+  initContainers:
+  - args:
+    - istio-iptables
+    - -p
+    - "15001"
+    - -z
+    - "15006"
+    - -u
+    - "1337"
+    - -m
+    - REDIRECT
+    - -i
+    - '*'
+    - -x
+    - ""
+    - -b
+    - '*'
+    - -d
+    - 15090,15021,15020
+    - --log_output_level=default:info
+    image: gcr.io/istio-testing/proxyv2:latest
+    name: istio-init
+    resources:
+      limits:
+        cpu: "2"
+        memory: 1Gi
+      requests:
+        cpu: 100m
+        memory: 128Mi
+    securityContext:
+      allowPrivilegeEscalation: false
+      capabilities:
+        add:
+        - NET_ADMIN
+        - NET_RAW
+        drop:
+        - ALL
+      privileged: false
+      readOnlyRootFilesystem: false
+      runAsGroup: 0
+      runAsNonRoot: false
+      runAsUser: 0
+  - image: fake.docker.io/google-samples/hello-go-gke:1.0
+    name: override-sidecar
+    ports:
+    - containerPort: 80
+      name: http
+    readinessProbe:
+      httpGet:
+        path: /app-health/override-sidecar/readyz
+        port: 15020
+    resources: {}
+    restartPolicy: Always
+      - image: fake.docker.io/google-samples/hello-go-gke:1.0
+    name: other-sidecar
+    ports:
+    - containerPort: 80
+      name: http
+    readinessProbe:
+      httpGet:
+        path: /app-health/other-sidecar/readyz
+        port: 15020
+    resources: {}
+    restartPolicy: Always
+  - args:
+    - proxy
+    - sidecar
+    - --domain
+    - $(POD_NAMESPACE).svc.cluster.local
+    - --proxyLogLevel=warning
+    - --proxyComponentLogLevel=misc:error
+    - --log_output_level=default:info
+    env:
+    - name: PILOT_CERT_PROVIDER
+      value: istiod
+    - name: CA_ADDR
+      value: istiod.istio-system.svc:15012
+    - name: POD_NAME
+      valueFrom:
+        fieldRef:
+          fieldPath: metadata.name
+    - name: POD_NAMESPACE
+      valueFrom:
+        fieldRef:
+          fieldPath: metadata.namespace
+    - name: INSTANCE_IP
+      valueFrom:
+        fieldRef:
+          fieldPath: status.podIP
+    - name: SERVICE_ACCOUNT
+      valueFrom:
+        fieldRef:
+          fieldPath: spec.serviceAccountName
+    - name: HOST_IP
+      valueFrom:
+        fieldRef:
+          fieldPath: status.hostIP
+    - name: ISTIO_CPU_LIMIT
+      valueFrom:
+        resourceFieldRef:
+          divisor: "0"
+          resource: limits.cpu
+    - name: PROXY_CONFIG
+      value: |
+        {}
+    - name: ISTIO_META_POD_PORTS
+      value: |-
+        [
+            {"name":"http","containerPort":80}
+        ]
+    - name: ISTIO_META_APP_CONTAINERS
+      value: hello
+    - name: GOMEMLIMIT
+      valueFrom:
+        resourceFieldRef:
+          divisor: "0"
+          resource: limits.memory
+    - name: GOMAXPROCS
+      valueFrom:
+        resourceFieldRef:
+          divisor: "0"
+          resource: limits.cpu
+    - name: ISTIO_META_CLUSTER_ID
+      value: Kubernetes
+    - name: ISTIO_META_NODE_NAME
+      valueFrom:
+        fieldRef:
+          fieldPath: spec.nodeName
+    - name: ISTIO_META_INTERCEPTION_MODE
+      value: REDIRECT
+    - name: ISTIO_META_WORKLOAD_NAME
+      value: hello
+    - name: ISTIO_META_OWNER
+      value: kubernetes://apis/v1/namespaces/default/pods/hello
+    - name: ISTIO_META_MESH_ID
+      value: cluster.local
+    - name: TRUST_DOMAIN
+      value: cluster.local
+    - name: ISTIO_KUBE_APP_PROBERS
+      value: '{"/app-health/other-sidecar/readyz":{"httpGet":{"port":3333}},"/app-health/override-sidecar/readyz":{"httpGet":{"port":3333}}}'
+    image: gcr.io/istio-testing/proxyv2:latest
+    lifecycle:
+      preStop:
+        exec:
+          command:
+          - pilot-agent
+          - request
+          - --debug-port=15020
+          - POST
+          - drain
+    name: istio-proxy
+    ports:
+    - containerPort: 15090
+      name: http-envoy-prom
+      protocol: TCP
+    readinessProbe:
+      failureThreshold: 4
+      httpGet:
+        path: /healthz/ready
+        port: 15021
+      periodSeconds: 15
+      timeoutSeconds: 3
+    resources:
+      limits:
+        cpu: "2"
+        memory: 1Gi
+      requests:
+        cpu: 100m
+        memory: 128Mi
+    restartPolicy: Always
+    securityContext:
+      allowPrivilegeEscalation: false
+      capabilities:
+        drop:
+        - ALL
+      privileged: false
+      readOnlyRootFilesystem: true
+      runAsGroup: 1337
+      runAsNonRoot: true
+      runAsUser: 1337
+    startupProbe:
+      failureThreshold: 600
+      httpGet:
+        path: /healthz/ready
+        port: 15021
+      periodSeconds: 1
+      timeoutSeconds: 3
+    volumeMounts:
+    - mountPath: /var/run/secrets/workload-spiffe-uds
+      name: workload-socket
+    - mountPath: /var/run/secrets/credential-uds
+      name: credential-socket
+    - mountPath: /var/run/secrets/workload-spiffe-credentials
+      name: workload-certs
+    - mountPath: /var/run/secrets/istio
+      name: istiod-ca-cert
+    - mountPath: /var/run/secrets/istio/crl
+      name: istio-ca-crl
+    - mountPath: /var/lib/istio/data
+      name: istio-data
+    - mountPath: /etc/istio/proxy
+      name: istio-envoy
+    - mountPath: /var/run/secrets/tokens
+      name: istio-token
+    - mountPath: /etc/istio/pod
+      name: istio-podinfo
+  volumes:
+  - name: workload-socket
+  - name: credential-socket
+  - name: workload-certs
+  - emptyDir:
+      medium: Memory
+    name: istio-envoy
+  - emptyDir: {}
+    name: istio-data
+  - downwardAPI:
+      items:
+      - fieldRef:
+          fieldPath: metadata.labels
+        path: labels
+      - fieldRef:
+          fieldPath: metadata.annotations
+        path: annotations
+    name: istio-podinfo
+  - name: istio-token
+    projected:
+      sources:
+      - serviceAccountToken:
+          audience: istio-ca
+          expirationSeconds: 43200
+          path: istio-token
+  - configMap:
+      name: istio-ca-root-cert
+    name: istiod-ca-cert
+  - configMap:
+      name: istio-ca-crl
+      optional: true
+    name: istio-ca-crl
+status: {}
+---
@@ -2,6 +2,8 @@ apiVersion: v1
 kind: Pod
 metadata:
   name: hello
+  annotations:
+    "sidecar.istio.io/init-containers-before-proxy": "other-sidecar"
 spec:
   initContainers:
     - name: other-sidecar

@@ -8,6 +8,7 @@ metadata:
     prometheus.io/path: /stats/prometheus
     prometheus.io/port: "15020"
     prometheus.io/scrape: "true"
+    sidecar.istio.io/init-containers-before-proxy: other-sidecar
     sidecar.istio.io/status: '{"initContainers":["istio-init","istio-proxy"],"containers":null,"volumes":["workload-socket","credential-socket","workload-certs","istio-envoy","istio-data","istio-podinfo","istio-token","istiod-ca-cert","istio-ca-crl"],"imagePullSecrets":null,"revision":"default"}'
   creationTimestamp: null
   labels:
@@ -65,6 +66,17 @@ spec:
       runAsGroup: 0
       runAsNonRoot: false
       runAsUser: 0
+  - image: fake.docker.io/google-samples/hello-go-gke:1.0
+    name: other-sidecar
+    ports:
+    - containerPort: 80
+      name: http
+    readinessProbe:
+      httpGet:
+        path: /app-health/other-sidecar/readyz
+        port: 15020
+    resources: {}
+    restartPolicy: Always
   - args:
     - proxy
     - sidecar
@@ -207,17 +219,6 @@ spec:
       name: istio-token
     - mountPath: /etc/istio/pod
       name: istio-podinfo
-  - image: fake.docker.io/google-samples/hello-go-gke:1.0
-    name: other-sidecar
-    ports:
-    - containerPort: 80
-      name: http
-    readinessProbe:
-      httpGet:
-        path: /app-health/other-sidecar/readyz
-        port: 15020
-    resources: {}
-    restartPolicy: Always
   volumes:
   - name: workload-socket
   - name: credential-socket