Istio sidecar cycling

[mjnagel]

Is your feature request related to a problem? Please describe.

When istio updates to a new version it does not automatically roll out new sidecars to every injected pod. The typical options for handling this include:

• Delete/cycle the pods manually yourself
• Add an annotation to each injected pod with the istio version, updating this annotation across pods should auto-cycle them
• Use a controller/operator to auto-cycle pods to the latest sidecar on update to istio
• ???

Describe the solution you'd like

A new pepr capability seems like a great fit for this problem. The desired state would be:

When a new version of istio rolls out to my cluster, all istio injected pods gracefully cycle to get the latest sidecar image

OpenKruise has an interesting way that they handle in place sidecar updates - https://openkruise.io/docs/user-manuals/sidecarset - haven't dug into what they are doing but it could be interesting to look at how that works.

Describe alternatives you've considered

Continue to handle this manually or manually add the annotation/label via values.

Additional context

Big Bang umbrella "solved" this by adding the istio git version to every pod as an annotation.