PandoCore | Three Silent Failures Between You and Sidecar Injection
Skip to main content
Three Silent Failures Between You and Sidecar Injection
August 13, 2026 · By Eliot Ferstl
Running kubectl label deployment my-app pandocore.io/inject=enabled modifies the Deployment's top-level metadata.labels, not spec.template.metadata.labels. Those are two different things, and the difference is the bug.
Sidecar injection works through a mutating admission webhook that fires when a pod is created. The webhook matches on the pod's labels. Pods inherit their labels from exactly one place: the Deployment's pod template. Labels on the Deployment object itself never propagate down to pods. They exist so you can select the Deployment with things like kubectl get deploy -l team=payments.
So when you label the Deployment, three things go wrong at once, all silently. First, kubectl prints deployment.apps/my-app labeled. Success. Second, because the pod template didn't change, the Deployment controller sees nothing to do, so no rollout happens and no new pods are created. Third, even if pods were recreated, they wouldn't carry the label, so the webhook would never match them. There is no error at any layer. You check the Deployment, the label is right there, and every pod is still running 1/1 with no sidecar in sight.
We hit this while reviewing our own onboarding docs. The instruction looked correct, the command succeeded, and injection never happened. It's an easy mistake to ship because nothing anywhere tells you it didn't work.
The fix is to put the label where pods are actually born: the pod template.
kubectl patch deployment my-app --type merge \<br>-p '{"spec":{"template":{"metadata":{"labels":{"pandocore.io/inject":"enabled"}}}}}'
Because this changes the pod template, it triggers a rollout on its own. The controller creates a new ReplicaSet, and every new pod comes up with the label and passes through the webhook. If you set the label some other way and aren't sure the template has changed, kubectl rollout restart deployment my-app forces fresh pods. Verify with kubectl get pods -l pandocore.io/inject=enabled. The containers column should now read 2/2.
Label the template, roll the pods, check the count. The Deployment's own labels were never going to do it.
← Back to all posts