Kubernetes Istio Sidecar Injection Omission Sentinel

Audits active workloads across Kubernetes namespaces designated for Istio service mesh participation, detecting pods operating without the mandatory Envoy sidecar proxy (istio-proxy), preventing plaintext unencrypted communication and security policy bypasses.

How it works

1. Namespace Workload Discovery: Interrogates the Kubernetes CoreV1Api enumerating active pods across target production namespaces.
2. Sidecar Container Verification: Inspects pod spec container lists verifying the existence of the configured Envoy proxy sidecar container.
3. Zero-Trust Security Evaluation: Identifies unmeshed pods and evaluates total omission counts against configured alert tolerance ceilings.
4. SecOps Notification Dispatch: Dispatches rich incident notifications to Slack specifying unmeshed pod names, namespaces, and remediation commands.

Architecture diagram

flowchart TD
    A[periodic_istio_audit Schedule Trigger] --> B[scan_unmeshed_workloads Python Script]
    B --> C[check_unmeshed_pod_count Flowable If]
    C -- Threshold Breached --> D[notify_slack_mesh_alert Webhook]
    C -- Metrics Nominal --> E[log_nominal_mesh_state Log]
    D --> E
    E --> F[export_mesh_manifest Return]

Architecture components

• Trigger (periodic_istio_audit): Drives scheduled recurring surveillance cycles without human intervention.
• Inspection Task (scan_unmeshed_workloads): Queries target APIs and structures diagnostic indicators via Kestra outputs.
• Evaluation Gate (check_unmeshed_pod_count): Evaluates operational safety boundaries using deterministic boolean branching.
• Notification Action (notify_slack_mesh_alert): Dispatches rich, actionable incident messages directly to team channels.
• Manifest Return (export_mesh_manifest): Emits structured compliance payloads for SIEM and analytics records.

Key capabilities

• Automated Health Polling: Continuous scheduled surveillance executed on customizable recurring intervals without dedicated agent daemons.
• Deterministic Threshold Evaluation: Pure boolean and numeric tolerance checks eliminating false positives and alert noise.
• Contextual Incident Notification: Rich Slack messages populated with explicit resource identifiers, error reasons, and metrics.
• Machine-Readable Audit Manifest: Structured execution telemetry exported for compliance archives, SIEM ingestion, or analytics dashboards.

What you get

• Continuous automated surveillance of Istio mutual TLS (mTLS) compliance across enterprise namespaces
• Early warning for namespace label omissions (istio-injection=enabled) or pod template annotation overrides
• Prevention of security perimeter bypasses where unmeshed workloads communicate in unauthenticated plaintext
• Structured compliance manifest detailing total pods scanned, unmeshed identifiers, and audit timestamps

Who it's for

• DevSecOps Engineers maintaining zero-trust architecture compliance and mTLS encryption standards
• Platform Engineers operating Istio, Linkerd, or Consul service meshes across multi-tenant clusters
• Site Reliability Engineers troubleshooting asymmetric routing and telemetry blindspots in service graphs

Why orchestrate this with Kestra

• Lightweight scheduled execution inspecting cluster workloads without deploying heavy in-cluster daemon sets
• Secure secret management safeguarding administrative kubeconfig credentials within encrypted vaults
• Configurable Flowable branching separating routine informational logging from urgent security escalations
• Extensible workflow engine capable of triggering automated pod deletion or rollout restarts

Use cases

• Namespace Migration Validation: Ensure newly onboarded microservice namespaces have enabled automatic Istio sidecar injection.
• Annotation Bypass Detection: Flag application pods configured with sidecar.istio.io/inject: false attempting to bypass security gates.
• Job and CronJob Injection Auditing: Audit transient batch jobs to ensure ephemeral workloads adhere to mesh encryption policies.

Inputs

Name	Type	Default	Description
target_namespaces	STRING	production,payments,customer-api	Comma-separated list of Kubernetes namespaces with mandatory Istio sidecar injection.
sidecar_container_name	STRING	istio-proxy	Expected name of the Envoy proxy container injected into workload pods.
omission_threshold	INT	1	Threshold count of unmeshed pods that triggers an automated security alert.
alert_on_omission	BOOL	True	Toggle whether Slack webhook alerts are dispatched upon detecting pods running without sidecars.

Expected outputs

• {{ outputs.scan_unmeshed_workloads.vars.total_pods_scanned }}: Total number of active Kubernetes pods inspected across audited namespaces.
• {{ outputs.scan_unmeshed_workloads.vars.unmeshed_pod_count }}: Total count of active pods missing the mandatory Envoy proxy sidecar container.
• {{ outputs.scan_unmeshed_workloads.vars.unmeshed_pod_names }}: Comma-separated list of namespace/pod identifiers running without mesh sidecars.
• {{ outputs.scan_unmeshed_workloads.vars.is_alerting }}: Boolean flag indicating whether unmeshed pod count breached configured alert thresholds.

Prerequisites

• Istio service mesh deployed and active within the target Kubernetes cluster.
• Kubernetes ServiceAccount with get and list permissions on core v1 Pods across audited namespaces.
• Valid KUBECONFIG_DATA base64-encoded secret stored within Kestra namespace secret configuration.
• Configured Slack incoming webhook URL with permissions to post messages into the designated alert channel.

Secrets

• KUBECONFIG_DATA: Vault secret required for authenticated API execution and notifications.
• SLACK_WEBHOOK_URL: Vault secret required for authenticated API execution and notifications.

Quick start

1. Register required authentication credentials and webhook endpoints in Kestra namespace secrets.
2. Import this blueprint into your Kestra instance under the company.security namespace.
3. Review input defaults such as threshold limits, lookback windows, and alert toggles.
4. Execute the flow manually to verify network connectivity, API permissions, and Slack notifications.
5. Enable the automated schedule trigger to commence continuous background surveillance.

Common pitfalls and troubleshooting

• HostNetwork Pod Exclusions: Pods configured with hostNetwork: true cannot accept Istio sidecar injection; filter out hostNetwork workloads to prevent false alarms.
• Pending Pod Initialization: Pods during initial scheduling phase may not yet reflect injected containers; audit Running and Scheduled pods.
• DaemonSet Compatibility: Certain infrastructure DaemonSets (e.g. node-exporter) intentionally run unmeshed; maintain an explicit exclusion list.
• Kubeconfig RBAC Boundaries: Ensure the ServiceAccount token has cluster-wide or multi-namespace list permissions across all targeted namespaces.

How to extend

• Automated Pod Eviction: Trigger automated kubectl delete pod commands to force rescheduling through the mutating admission webhook.
• Namespace Label Enforcement: Automatically apply the label istio-injection=enabled to namespaces found missing sidecar configuration.
• Jira Ticket Generation: Create automated security non-compliance tickets assigned to application team leads for unmeshed workloads.

Links

• Kestra Python Script Plugin Documentation
• Kestra Slack Plugin Documentation
• Istio Sidecar Injection Architecture Guide
• Kubernetes CoreV1Api Python Client Documentation
• Troubleshooting Istio Injection Failures