Istio proxy runs as init container vs sidecar

 Istio

    

Istio proxy parameters for running proxy as sidecar:

- proxy

- sidecar

- --domain

- $(POD_NAMESPACE).svc.cluster.local

- --proxyLogLevel=warning

- --proxyComponentLogLevel=misc:error

- --log_output_level=default:info

- --concurrency

- "2"

Other differences:

allowPrivilegeEscalation: false

capabilities:

drop:

- ALL

privileged: false

readOnlyRootFilesystem: true

runAsGroup: 1337

runAsNonRoot: true

runAsUser: 1337

Istio proxy parameters for running proxy as init container:

- istio-iptables

- -p

- "15001"

- -z

- "15006"

- -u

- "1337"

- -m

- REDIRECT

- -i

- '*'

- -x

- ""

- -b

- '*'

- -d

- 15090,15021,15020

Other differences:

allowPrivilegeEscalation: false

capabilities:

add:

- NET_ADMIN

- NET_RAW

drop:

- ALL

privileged: false

readOnlyRootFilesystem: false

runAsGroup: 0

runAsNonRoot: false

runAsUser: 0