The attached control plane which is a 1.x SMCP deployed using OSSM operator 2.0.0-2 successfully deploys and injects sidecars to pods in a project that is labeled properly (iad-devops-dev) but pods in that namespace show "Missing Sidecar" in Kiali and don't join the mesh.

The customer had previously rolled in some custom certs, and when that caused this issue, they rolled them back out and attempted to completely remove and reinstall the mesh with the self Signed: true, and have been seeing this issue since.

The current thinking is that there's either some old resource from an old install that is breaking the new installs, or that there's some bug with the injection as there are no logs at all about this in Kiali, the sidecar itself (which starts and runs fine), or the istio-sidecar-injector pod.

I am marking this as private as I'm uploading customer data. Unfortunately we have not been successful in troubleshooting this so far so forgive me if this is a configuration issue rather than a reproduceable bug.

Attached is the istio must-gather but I also have a full one if needed.