Skip to content

Istio Sidecar Injection Failure

Symptom

A workload that should join the mesh starts without an istio-proxy container, or only some pods in the namespace receive the sidecar.

Possible Causes

  • The namespace uses istio-injection=enabled instead of the required revision label.
  • The namespace label points to the wrong or old Istio revision.
  • Workloads were never restarted after labeling the namespace.
  • Admission webhook or control-plane health is degraded.
  • Pod template metadata drift disables or interferes with injection.

Diagnosis Steps

flowchart TD
    A[Pod has no istio-proxy] --> B[Check namespace labels]
    B --> C{Correct istio.io/rev label?}
    C -->|No| D[Fix namespace label]
    C -->|Yes| E[Check control-plane pods and webhooks]
    E --> F{Healthy?}
    F -->|No| G[Restore addon health]
    F -->|Yes| H[Restart workload and inspect pod template]
    H --> I[Fix annotation or template drift]

  1. Inspect the namespace labels.

    kubectl get namespace <namespace> \
    --show-labels

    Confirm the namespace uses istio.io/rev=asm-X-Y.

  2. Check installed revisions.

    az aks show \
    --resource-group "$RG" \
    --name "$CLUSTER_NAME" \
    --query "serviceMeshProfile.istio.revisions" \
    --output json
    Command Purpose
    az aks show Show the installed Istio revisions.
    --resource-group Resource group that contains the AKS cluster.
    --name Name of the AKS cluster.
    --query Selects the Istio mesh revisions.
    --output Output format for the result.

  3. Inspect Istio control-plane pods.

    kubectl get pods \
    --namespace aks-istio-system

  4. Restart the workload if the namespace was labeled after the deployment already existed.

    kubectl rollout restart deployment/<deployment-name> \
    --namespace <namespace>

  5. Inspect a newly created pod.

    kubectl describe pod <pod-name> \
    --namespace <namespace>

  6. Compare the deployment template with known-good workloads if only one app misses injection.

Resolution

  • Replace istio-injection=enabled with the correct istio.io/rev namespace label.
  • Use a supported installed revision value.
  • Restart workloads after namespace onboarding.
  • Recover add-on control-plane health if istiod or admission components are failing.
  • Remove conflicting pod-template settings if application manifests introduced injection drift.

Prevention

  • Standardize namespace onboarding with explicit revision labels.
  • Include sidecar-presence checks in post-deploy validation.
  • Keep one documented process for minor revision upgrades and namespace relabeling.
  • Treat sidecar injection as a platform contract that app teams should not override casually.

See Also

Sources