Sidecar.istio.io/inject: "true" has no affect

Config
1

I set this spec [1] in grafana deployment to Istio-system namespace which doesn’t have label " istio-injection=enabled". My understanding is that by adding sidecar.istio.io/inject: “true” to deployment, Istio would automatically inject sidecars; however, I only see grafana container from the grafana pod. Am I missing something here?

[1]

spec:
  progressDeadlineSeconds: 600
  replicas: 1
  revisionHistoryLimit: 10
  selector:
    matchLabels:
      app: grafana
  strategy:
    rollingUpdate:
      maxSurge: 25%
      maxUnavailable: 25%
    type: RollingUpdate
  template:
    metadata:
      annotations:
        prometheus.io/scrape: "true"
        sidecar.istio.io/inject: "true"
      creationTimestamp: null
      labels:
        app: grafana
        chart: grafana
        heritage: Tiller
        release: istio
2

Check out resource mutatingwebhookconfiguration; in webhooks.namespaceSelector.matchExpressions it has filtering rules that require the label. If this selector does not match your namespace, the webhook won’t be invoked and istio-sidecar-injector can’t even start looking into your spec.

I found this blogpost very useful: https://bani.com.br/2018/09/istio-sidecar-injection-enabling-automatic-injection-adding-exceptions-and-debugging/