gistfile1.txt

Yahoo Implementation of Istio CNI:
-----------------------------------

Yahoo didn't adopt the native method of running istio-cni-node Daemonset for the following reasons,
     1. There could be a chance of race condition that a POD can be launched without istio-proxy sidecar,
     when the istiocni DS pod is shutting down as it remove the istio cni chained plugin configuration
     from CNI config file(/etc/cni/net.d/10-ptp.conflist).
     2.  Daemonset ISTIO-CNI-NODE conflicted the on-perm implementation of CNI config file Management.
    

In-house kube-node bootstrap process will setup the following related to istio-cni,
        1. istio-cni binary, istio-iptables.sh (use the same from istio-cni-node DS).
        2. CNI configuration with chained istio-cni plugin.
        3. kubeconfig, credentials need by istio-cni binary to communicate with kube-api.
        
Any kube-node brought in to the cluster will have istio-cni and mandate the pod initializing passing istio-cni.