Senior LevelDocker & Deployment
How does the Native Sidecar Container lifecycle feature in K8s 1.28+ solve startup order problems?
❓ Interview Prompt: Explain the K8s 1.28+ native sidecar initContainer pattern, startup/shutdown ordering guarantees, and migration from workarounds like preStop hooks.
The Classic Sidecar Problem:
Traditional Kubernetes has no ordering guarantees for containers within the same pod — all containers start simultaneously. This creates problems:
1
Startup: App container starts before the Istio/Envoy proxy sidecar is ready — early requests fail.
2
Shutdown: During
kubectl drain, Kubernetes sends SIGTERM to all containers simultaneously. The Envoy proxy shuts down before the app finishes draining its in-flight requests.Previous Workarounds (Pre-K8s 1.28):
•
Init container that runs
sleep infinity after signaling readiness (hack).•
preStop: sleep 5 in app container to wait for proxy to finish shutting down.•
Lifecycle hooks checking proxy readiness.
Native Sidecar Containers (K8s 1.28+ GA in 1.29):
Defined as initContainers with restartPolicy: Always:
•
Start BEFORE all regular containers (like init containers).
•
Persist after their init-like setup (unlike init containers — don't exit).
•
Shutdown AFTER all regular containers have exited.
•
Participate in the Pod's
readinessGate — pod is only ready when sidecar is ready.•
Support normal container fields:
livenessProbe, readinessProbe, resources.Code Implementation Example
yaml
# K8s 1.28+: Native sidecar container (initContainer + restartPolicy: Always)
apiVersion: v1
kind: Pod
spec:
initContainers:
# Native sidecar: starts FIRST, runs throughout pod lifetime, shuts down LAST
- name: envoy-proxy
image: envoyproxy/envoy:v1.28
restartPolicy: Always # KEY: this makes it a native sidecar!
ports:
- containerPort: 15001
readinessProbe:
httpGet:
path: /ready
port: 15000
initialDelaySeconds: 1
periodSeconds: 2
lifecycle:
preStop:
exec:
command: ["/bin/sh", "-c", "curl -X POST localhost:15000/quitquitquit"]
containers:
- name: app
image: myapp:v1.2.3
# Envoy is guaranteed to be READY before app starts (readinessProbe above)
# Envoy drains connections AFTER app exits (shutdown ordering)
# Ordering guarantees:
# Startup: envoy-proxy starts + ready → app starts
# Shutdown: app gets SIGTERM → app drains → app exits → envoy gets SIGTERM → envoy exits💡Native sidecar (initContainer + restartPolicy:Always): Envoy starts before app, stays running throughout, shuts down after app exits.
🎯 Interview Key Takeaway
K8s 1.28+ native sidecars (initContainers + restartPolicy:Always) guarantee: start before main containers, run throughout pod lifetime, and shut down after main containers exit — eliminating all sidecar ordering hacks.
#Kubernetes#Sidecar#Native Sidecar#Lifecycle#Service Mesh#Senior
Back to all Docker & Deployment Questions→