Should the istio sidecar injector have policy=enabled?

[grantr]

/area networking

Currently we configure the istio sidecar injector to use policy: disabled, which tells it to only inject the Istio proxy when the pod has a specific annotation. The alternative is to use policy: enabled, which injects the Istio proxy in all pods in enabled namespaces (the namespace must have injection enabled via a label).

Which configuration do we expect customers to use? We should probably use that one as the default. @ian-mi thinks customers are most likely to use policy: enabled. @mdemirhan WDYT?

[ian-mi]

If there are no objections, I will go ahead and set policy: enabled in our istio build rules.

[evankanderson]

Is this still active? Nghia did some investigation in istio/istio#6476 (comment)

/assign @tcnghia

[evankanderson]

/kind cleanup

[tcnghia]

I think we want to use annotation on the Pods we create on behalf of the users, so that we can be robust against the Istio settings that users have on their side.