NGINX Documentation

• NGINX Plus
• NGINX Controller
• NGINX Instance Manager
• NGINX App Protect
• NGINX Ingress Controller for Kubernetes
• NGINX Service Mesh
  • Getting Started
  • Setup
  • Guides
  • Tutorials
  • Reference
  • Support
  • Releases
• NGINX Unit
• NGINX Amplify
• F5 DNS Cloud Services

---

What's on this Page

---

Sidecar Proxy Injection

Overview

NGINX Service Mesh works by injecting a sidecar proxy into Kubernetes resources. You can choose to inject the sidecar proxy into the YAML or JSON definitions for your Kubernetes resources in the following ways:

• Automatic Injection
• Manual Injection

Note:

When you inject the sidecar proxy into a Kubernetes resource, the injected config uses the global mTLS setting. You can define the global setting when you deploy NGINX Service Mesh, or use the default setting.

Refer to Secure Mesh Traffic using mTLS for more information.

Important:

The sidecar proxy will not be injected into pods that define multiple container ports with the same port number or for container ports with protocols of SCTP or UDP.

The mesh only supports TCP container ports.

The mesh supports the following Kubernetes resources and API versions for injection:

Resource Type	API Version
Deployment	apps/v1
DaemonSet	apps/v1
StatefulSet	apps/v1
ReplicaSet	apps/v1
ReplicationController	v1
Pod	v1
Job	batch/v1

Automatic Proxy Injection

NGINX Service Mesh uses automatic injection by default. This means that any time a user creates a Kubernetes Pod resource, the NGINX Service Mesh automatically injects the sidecar proxy into the Pod. Automatic injection applies to all namespaces in your Kubernetes cluster.

Enable or Disable Automatic Proxy Injection by Namespace

By default, NGINX Service Mesh can access resources in all Kubernetes namespaces.

To disable this setting, you must deploy the mesh using the --disable-auto-inject flag:

nginx-meshctl deploy ... --disable-auto-inject

If you want to enable automatic injection only in specific namespaces, add the --enabled-namespaces flag to your deploy command.

For example, to disable automatic injection in all namespaces and enable it only in the namespaces “prod” and “staging”, you would run the following command:

nginx-meshctl deploy ... --disable-auto-inject --enabled-namespaces="prod,staging"

Similarly, you can deploy NGINX Service Mesh with automatic injection enabled and specify a list of the namespaces that you want to exclude. To do so, use the --disabled-namespaces flag when you deploy.

The following deploy command enables automatic injection in all namespaces except “test”:

nginx-meshctl deploy ... --disabled-namespaces="test"

Enable or Disable Automatic Proxy Injection on a Resource

For more granular control, you can override the global automatic injection setting on a per-resource basis. To do so, add the following annotation to the resource’s PodSpec:

injector.nsm.nginx.com/auto-inject: "true|false"

Manual Proxy Injection

To inject the sidecar proxy into a resource manually, use the nginx-meshctl inject command. Provide the path to the resource definition file and your desired output filename.

nginx-meshctl inject < <resource-file> > <new-resource-file>

For example, the following command will write the updated config for “resource.yaml” to a new file, “resource-injected.yaml”:

nginx-meshctl inject < resource.yaml > resource-injected.yaml

Ignore Specific Ports

You can set the proxy to ignore ports for either incoming or outgoing traffic. The NGINX Service Mesh applies the configurations at injection time.

• For automatic injection, add the following annotations to the PodSpec in your resource definition:

  config.nsm.nginx.com/ignore-incoming-ports: "port1, port2, ..., portN"
  config.nsm.nginx.com/ignore-outgoing-ports: "port1, port2, ..., portN"
  

• For manual injection, you can use the annotations above or specify the ports when running the nginx-meshctl inject command.

  nginx-meshctl inject --ignore-incoming-ports "port1,port2,...,portN", --ignore-outgoing-ports "port1,port2,...,portN" < resource.yaml > resource-injected.yaml
  

HTTPGet Health Probe Rewrite

If mTLS mode is set to strict, then readiness, liveness, and startup probes using HTTP GET do not work. This is due to kubelet not having the correct client certificates. To remedy this, application HTTP/S health probes are rewritten at injection time. The new probes point to an endpoint on the sidecar proxy, which redirects the health check to the original destination on the application. This allows the health check to bypass the SSL verification, while still sending the health check to the intended destination.

---

• Monitoring and Tracing

---