How to Fix Istio Sidecar Injection Issues

In this tutorial, you'll learn about How to Fix Istio Sidecar Injection Issues. We cover key concepts, practical examples, and best practices.

The Problem

Your pod is not getting the Istio sidecar proxy injected, or the sidecar is injected but crashes immediately. kubectl get pods shows only one container, or the envoy proxy shows CrashLoopBackOff with Initializing Istio DNS errors.

Quick Fix

Fix 1: Sidecar Not Injected

WRONG — namespace not labeled for injection:

kubectl get namespace default --show-labels
# No labels — sidecar injection is not enabled

kubectl get pod my-app -o yaml | grep -c "istio-proxy"
# 0 — no sidecar injected

RIGHT — label the namespace:

kubectl label namespace default istio-injection=enabled
# namespace/default labeled

# Delete and recreate the pod to trigger injection:
kubectl delete pod my-app
kubectl get pod my-app -o yaml | grep -c "istio-proxy"
# 2 (one app container + istio-proxy)

Fix 2: Pod-Level Annotation Override

WRONG — the pod explicitly disables injection:

metadata:
  annotations:
    sidecar.istio.io/inject: "false"  # overrides namespace label

RIGHT — remove or set to "true":

metadata:
  annotations:
    sidecar.istio.io/inject: "true"

Fix 3: Envoy Proxy Crashing

kubectl logs my-app -c istio-proxy
# [Envoy (E)] Privilege check failed (error 1)
# [Envoy (E)] Initializing Istio DNS
# (crashes immediately)

RIGHT — check if the sidecar has sufficient resources:

spec:
  template:
    metadata:
      annotations:
        sidecar.istio.io/proxyCPU: "100m"
        sidecar.istio.io/proxyMemory: "128Mi"
        sidecar.istio.io/proxyCPULimit: "500m"
        sidecar.istio.io/proxyMemoryLimit: "512Mi"

Fix 4: IPTables Redirect Conflicts

# Application container binds to port 80, but envoy also needs port 80
# Error: "listen tcp 0.0.0.0:80: bind: address already in use"

RIGHT — configure the application to listen on a different port or use traffic.sidecar.istio.io/includeInboundPorts annotation:

metadata:
  annotations:
    traffic.sidecar.istio.io/includeInboundPorts: "8080"

Fix 5: Startup Race Condition

# Application starts before envoy is ready and crashes
# Error: "connection refused" when trying to connect to other services

RIGHT — add a startup probe or use holdApplicationUntilProxyStarts:

metadata:
  annotations:
    sidecar.istio.io/rewriteAppHTTPProbers: "true"
    proxy.istio.io/config: |
      holdApplicationUntilProxyStarts: true

Fix 6: Istio Not Installed

kubectl get ns istio-system
# Error from server: namespace "istio-system" not found
# (Istio is not installed in the cluster)

RIGHT — install Istio:

istioctl install --set profile=default -y
# ✔ Istio core installed
# ✔ Istiod installed
# ✔ Ingress gateways installed

Use DodaTech's Mesh Diagnostics to verify sidecar injection, check envoy configuration, and troubleshoot service-to-service connectivity in the mesh.

Prevention

• Label namespaces with istio-injection=enabled for automatic injection.
• Set appropriate resource limits for the sidecar proxy.
• Test injection on a non-production namespace first.
• Monitor sidecar startup with kubectl logs -c istio-proxy.
• Use istioctl proxy-status to verify mesh connectivity.

Common Mistakes with istio sidecar

1. Using return to exit a function early instead of wrapping a pure value in the monad
2. Mixing let bindings with <- bindings in do notation, producing type errors
3. Overlapping type class instances that cause GHC to reject the program with ambiguous dispatch errors

These mistakes appear frequently in real-world K8S code. DodaTech's contributors have identified these patterns through analysis of open-source projects and production systems.

Practice Exercise

Write a pure function that safely divides two integers using Maybe, then test it with edge cases like division by zero and negative numbers.

This exercise reinforces the concepts covered in this guide. Try implementing it before checking online solutions.

FAQ