I have a test k8s environment, my test NS has the istio-injection=true label. I have Istio installed. My app and istio injection work fine. After a while, I needed to delete Istio, so I did
istioctl x uninstall --purge
It was reported as successful. I did not remove the istio injection label from the NS, and performed another deployment.
The yaml files was applied successfully, but the deployment stuck. I found an error event in the replicaset resource saying something like:
could not call istio... webhook
I removed the istio injection label on the NS and did the deployment again, then everything went through.
So, it looks like even after I purged Istio and I checked my cluster that there's no trace of istio resource, k8s can still somehow recognise that istio-injection=true label and tried to perform the sidecar injection.
I wonder if Istio is not completely removed from my cluster. How can I check who is registered to read a certain label?
Had the same issue today. It turns out I had istio injection enabled on my argoCD namespace. And when I purged istio our cluster got hibernated and came back up but argoCD just never recovered.
Turns out adding istio-injection=true to the argocd namespace solved the issue after several minutes.
Note I also deleted the validation webhooks of istio but this did not solve the problem!