kubernetes - Why iptables rule setup in initContainer `istio-init` works in application container?

Question

I am reading the doc of istio. It says:

istio-init This init container is used to setup the iptables rules so that inbound/outbound traffic will go through the sidecar proxy.

In my understanding, initContainer and application container are separated except that they share same network namespace. So why would iptables setup in initContainer still persist in application container?

标签： kubernetesistio

Answer 1

As I mentioned in the comments, Iptables rules are briefly described here.

There is also a Iptables Schematic: