Exclude a service from being auto sidecar injected by istio

As you may know, you can enable automatic sidecar injection for a specific namespace with istio:

kubectl label namespace ABC istio-injection=enabled

It means that every new service deployed in the ABC namespace will be injected with an Envoy sidecar. In case you don't want a specific service such as MyService to be controlled by Istio, you can set the annotation 'sidecar.istio.io/inject' to 'false'. For example: