How does Istio inject sidecar proxies into Kubernetes pods?

Answer: By using a Kubernetes admission controller to automatically inject the sidecar

Explanation

Istio uses a Kubernetes admission controller to automatically inject the Envoy sidecar proxy into pods when they are created. This is typically enabled by adding a label to the namespace or pod template.