Skip to content
This repository has been archived by the owner. It is now read-only.
Switch branches/tags

Latest commit

* fix typo

* Change from apps/v1beta deployment  deprecated api to apps/v1

* Fixed docs deployment manifests

Git stats


Failed to load latest commit information.

CircleCI Go Report Card

App Mesh Inject

The AWS App Mesh Kubernetes sidecar injecting Admission Controller.

Security disclosures

If you think you’ve found a potential security issue, please do not post it in the Issues. Instead, please follow the instructions here or email AWS security directly.


Please reference the install instructions.


To align our helm repository and this repository we have changed the namespace to appmesh-system and resource names to appmesh-inject.

Under the hood

Enable Sidecar injection

To enable sidecar injection for a namespace, you need to label the namespace with

kubectl label namespace appmesh-demo

Default behavior and how to override

For namespaces with sidecar injection enabled, pods will be injected if the annotation is enabled and will not be injected if it is disabled. For pods with no annotation, they will be injected if the -inject-default=true flag is passed (the default for this flag) and will not be injected if the -inject-default=false flag is passed.

All container ports defined in the pod spec will be passed to sidecars as application ports. To override, add "<ports>" annotation to the pod spec.

By default all egress traffic ports will be routed, except SSH. To override, add "<ports>" annotation to the pod spec. ( Comma separated list of ports for which egress traffic will be ignored )

The name of the controller that creates the pod will be used as virtual node name and pass over to the sidecar. For example, if a pod is created by a deployment, the virtual node name will be <deployment name>-<namespace>. To override, add <virtual node name> annotation to the pod spec.

The mesh name provided at install time can be overridden with the <mesh name> annotation at POD spec level.

For example:

apiVersion: apps/v1
kind: Deployment
    name: my-cool-deployment
      name: appmesh-inject
      annotations: my-mesh "8079,8080" "22" my-app disabled

To see an example on how to use this sidecar injector you can visit the demo page.


CA bundle not configured properly

If the CA bundle isn't configured properly, the pod will log the following log message:

TLS handshake error from remote error: tls: bad certificate

If this happens, set the CA_BUNDLE environment variable to the content of the CA bundle. Make sure that this value is base64 encoded (e.g. it shouldn't start with -----BEGIN CERTIFICATE-----).