# Istio sidecar problem

**URL:** <https://discuss.konghq.com/t/istio-sidecar-problem/5002>\
**Category:** General\
**Tags:** kong-gateway\
**Created:** [November 26, 2019, 8:52am UTC](https://discuss.konghq.com/t/istio-sidecar-problem/5002 "2019-11-26T08:52:28Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![zhichuanxun](https://avatars.discourse-cdn.com/v4/letter/z/7ea924/32.png) [@zhichuanxun](https://discuss.konghq.com/u/zhichuanxun)\
**Post date:** [November 26, 2019, 8:52am UTC](https://discuss.konghq.com/t/istio-sidecar-problem/5002/1 "2019-11-26T08:52:28Z")

</div>

I got a problem when installing kong above istio.

basic information:

mode : postgresql (I have a requirement to use OAuth2 plugin which restrict me away from db-less mode)  
helm-version : 2.14.1  
chart-version : 0.26.1  
istio-version : 1.4  
kubernetes-version : v1.15.5

Since I labeled the installing namespace as `istio-injection=enabled` for the auto-injection. When I installed the kong through `helm install stable/kong`, the migration job cannot be completed normally. I find it’s a sidecar issue on Job resources ([Jobs are Broken (they Never Complete) · Issue #11045 · istio/istio · GitHub](https://github.com/istio/istio/issues/11045)).

I tried to disable the sidecar injection on Migration Job, it turns out that the migration job cannot find the postgersql pod.  
In the meantime, I tried to terminate the job manually through `kubectl exec gateway-kong-init-migrations-pq5cl-c istio-proxy -- curl -X POST localhost:15000/quitquitquit`, however, the kong pod stood still as “PodInitilizing”.

Since I’d like to view the traffic through kong api-gateway and do the monitoring and logging things, I want to integrate the kong into the service mesh layer. What can I do? Is there a way to modify the chart to complete the installation or just replace the kong pod later?

---

<div class="post-metadata">

**Author:** ![hbagdi](https://yyz2.discourse-cdn.com/flex036/user_avatar/discuss.konghq.com/hbagdi/32/562_2.png) [@hbagdi](https://discuss.konghq.com/u/hbagdi)\
**Post date:** [November 26, 2019, 6:45pm UTC](https://discuss.konghq.com/t/istio-sidecar-problem/5002/2 "2019-11-26T18:45:52Z")

</div>

Thanks for the detail post and relevant links.

There is nothing much that Kong can do for this bug with Istio/Kubernetes.  
One hack, that will require some heavy lifting is to add an init-container to the postgresql pod, which runs Kong migrations instead. This will strictly be a workaround though.

Do you really need a database for your use-case?  
You can deploy without a Database and essentially get almost the same set of features (with much simpler operations model).

---

<div class="post-metadata">

**Author:** ![zhichuanxun](https://avatars.discourse-cdn.com/v4/letter/z/7ea924/32.png) [@zhichuanxun](https://discuss.konghq.com/u/zhichuanxun)\
**Post date:** [November 27, 2019, 2:54am UTC](https://discuss.konghq.com/t/istio-sidecar-problem/5002/3 "2019-11-27T02:54:43Z")

</div>

Thanks for your suggestion, I will try it later.  
Yeah, I think dbless mode is good and suits the cloud native principle. However, I need OAuth2 plugin. There will be a lot of workloads if I change the authorization way. btw, does kong have any special support or plan to enable OAuth2 in dbless mode?

---

<div class="post-metadata">

**Author:** ![hbagdi](https://yyz2.discourse-cdn.com/flex036/user_avatar/discuss.konghq.com/hbagdi/32/562_2.png) [@hbagdi](https://discuss.konghq.com/u/hbagdi)\
**Post date:** [November 27, 2019, 5:33pm UTC](https://discuss.konghq.com/t/istio-sidecar-problem/5002/4 "2019-11-27T17:33:06Z")

</div>

> [@zhichuanxun](#):
>
> btw, does kong have any special support or plan to enable OAuth2 in dbless mode?

Yes. We are working on it. @bungle can provide more info on that.

---

<div class="post-metadata">

**Author:** ![zhichuanxun](https://avatars.discourse-cdn.com/v4/letter/z/7ea924/32.png) [@zhichuanxun](https://discuss.konghq.com/u/zhichuanxun)\
**Post date:** [November 28, 2019, 6:50pm UTC](https://discuss.konghq.com/t/istio-sidecar-problem/5002/5 "2019-11-28T18:50:52Z")

</div>

Hi, I check the installation today and I found it’s not the job problem.  
Actually, the migration command has done.

 ![image](https://canada1.discourse-cdn.com/flex036/uploads/konghq/original/2X/a/a1a7f257c0dfa650ab3eea3d1459f5d66d6bb560.png)  
However, the initcontainer “wait-for-db” in kong cannot run `kong start`. I exec the container and get the debug info as : ![image](https://canada1.discourse-cdn.com/flex036/uploads/konghq/original/2X/7/7160e15f124edb52bad6a24e1d8e6b6d4979853d.png)  
Actually, the postgresql can be accessed  
 ![image](https://canada1.discourse-cdn.com/flex036/uploads/konghq/original/2X/7/759dd54635b1f63749424f3acaf122c31fb87ea3.png)  
I don’t know what can I do to fix “unexpected message during auth”.