Fix: Istio Sidecar Not Injected Into Pods

!Symptoms

• Pods running with only 1/1 containers instead of 2/2
• Service mesh features (mTLS, traffic management) not working
• istio-proxy container missing from pod spec
• Inter-service communication not going through the mesh

?Root Causes

• Namespace not labeled for injection: missing `istio-injection=enabled`
• Pod annotation `sidecar.istio.io/inject: 'false'` overriding namespace label
• Istio webhook (istiod) not running or failing
• Webhook certificate expired preventing admission
• Pod created before namespace was labeled — existing pods don't get retroactive injection

#Diagnosis Steps

1. 1Check namespace label: `kubectl get ns <namespace> --show-labels | grep istio-injection`
2. 2Check pod annotations: `kubectl get pod <pod> -o yaml | grep sidecar.istio.io`
3. 3Verify istiod is running: `kubectl get pods -n istio-system`
4. 4Check webhook: `kubectl get mutatingwebhookconfigurations | grep istio`
5. 5Check istiod logs: `kubectl logs -n istio-system -l app=istiod`

>Fix

1. 1Label the namespace: `kubectl label namespace <ns> istio-injection=enabled`
2. 2Remove the opt-out annotation from the pod template
3. 3Restart istiod if the webhook is unhealthy: `kubectl rollout restart deploy/istiod -n istio-system`
4. 4Restart existing pods to trigger injection: `kubectl rollout restart deploy/<name>`
5. 5Regenerate webhook certificates if expired

*Prevention

• Include namespace labeling in your GitOps/Terraform manifests
• Use OPA/Gatekeeper to enforce sidecar injection on all namespaces
• Monitor sidecar injection success rate
• Automate certificate rotation for Istio webhooks
• Include sidecar verification in deployment pipelines

Related Error Messages