Update to Istio sidecar injection policy to avoid relying on / setting namespace level policy

DEVELOPMENT.md

@@ -125,12 +125,6 @@ kubectl create clusterrolebinding cluster-admin-binding \
 kubectl apply -f ./third_party/istio-0.8.0/istio.yaml
 ```
 
-Optionally label namespaces with `istio-injection=enabled`:
-
-```shell
-kubectl label namespace default istio-injection=enabled
-```
-
 Follow the [instructions](./docs/setting-up-ingress-static-ip.md) if you need 
 to set up static IP for Ingresses in the cluster.
 
@@ -144,7 +138,7 @@ kubectl apply -f ./third_party/config/build/release.yaml
 
 This step includes building Knative Serving, creating and pushing developer images and deploying them to your Kubernetes cluster.
 
-First, edit [config-network.yaml](config/config-network.yaml) as instructed within the file. 
+First, edit [config-network.yaml](config/config-network.yaml) as instructed within the file.
 If this file is edited and deployed after Knative Serving installation, the changes in it will be
 effective only for newly created revisions.
 

config/100-namespace.yaml

@@ -16,5 +16,3 @@ apiVersion: v1
 kind: Namespace
 metadata:
   name: knative-serving
-  labels:
-    istio-injection: enabled

hack/deploy.sh

@@ -64,8 +64,6 @@ header "Installing istio"
 kubectl apply -f ${ISTIO_YAML}
 wait_until_pods_running istio-system
 
-kubectl label namespace default istio-injection=enabled
-
 header "Installing Knative Serving"
 kubectl apply -f ${SERVING_RELEASE}
 

third_party/istio-0.8.0/README.md

@@ -6,4 +6,5 @@ This istio.yaml file is is generated by running
 Followed by:
 (1) adding the `istio-system` namespace (see PATCH #1 in the file), and
 (2) adding a Prestop sleep in the sidecar proxy, so that the proxy stays up a
-    little bit longer after Pod is being removed (see PATCH #2 in the file).
+    little bit longer after Pod is being removed (see PATCH #2 in the file), and
+(3) patching in https://github.com/istio/istio/pull/6439

third_party/istio-0.8.0/istio.yaml

@@ -630,7 +630,7 @@ metadata:
     istio: sidecar-injector
 data:
   config: |-
-    policy: enabled
+    policy: disabled
     template: |-
       initContainers:
       - name: istio-init
@@ -3257,10 +3257,12 @@ webhooks:
         resources: ["pods"]
     failurePolicy: Fail
     namespaceSelector:
-      matchLabels:
-        istio-injection: enabled
+      matchExpressions:
+      - key: istio-injection
+        operator: NotIn
+        values:
+        - disabled
+
 
 ---
 # Source: istio/charts/mixer/templates/config.yaml
-
-