Prep RoomSign inStart free
Code RoomStale sidecar config after control plane upgrade
HardPrep Room Coding #4569

Stale sidecar config after control plane upgrade

On-callReliability & on-callSenior–Staff~45 min

Your mesh does automatic mTLS between sidecars with certs rotated by the control plane's secret-discovery service (SDS). At 12:00 you pushed a routine PeerAuthentication policy change tightening mTLS to STRICT mesh-wide. Over the next 15 minutes, errors climb to 25% — but only between certain service pairs, and only for older pods. Dashboards: newer pods talk fine; older pods (started before a recent control-plane upgrade) get 'connection terminated' / TLS errors when called by STRICT-mode callers; control plane is healthy; sidecar proxies on old pods show stale config not yet reconciled. How do you triage and mitigate?

What a strong answer looks like

Stop the bleeding first (mitigate), then form hypotheses from real signals. Separate root cause from symptom, communicate status as you go, and close with what prevents a repeat.

0:00 of about 45 min
Which questions mattered is sealed until you submit. Telling you now would just be handing over the edge cases.