I realized that the injection-template.yaml will always add user volumeMounts (
sidecar.istio.io/userVolumeMount) to the sidecar container but will only add user volumes (
global.sds.enabled is set to
false. I did not see any mention in the documentation that user volumes may not be used with this setting enabled.
Is there any reason why the two annotations are treated differently w.r.t. global SDS?
In case there is not, which should be the preferred behavior, to always add or to conditionally add both the user volumes and user volumeMounts?