<p>We have some pods randomly get stuck in Init state. When describing those pods we see that the init container is Running but it is not marked as Ready. Also the logs don't show any errors for the init container.</p>
<pre><code>Init Containers:
  istio-init:
    Container ID:  &lt;id&gt;
    Image:         docker.io/istio/proxy_init:1.0.0
    Image ID:      docker-pullable://istio/proxy_init@sha256:345c40053b53b7cc70d12fb94379e5aa0befd979a99db80833cde671bd1f9fad
    Port:          &lt;none&gt;
    Host Port:     &lt;none&gt;
    Args:
      -p
      15001
      -u
      1337
      -m
      REDIRECT
      -i
      10.16.0.0/14,10.0.0.0/20
      -x

      -b
      4000,
      -d

    State:          Running                          &lt;---
      Started:      Wed, 08 Jul 2020 10:35:52 +0200
    Ready:          False                            &lt;---
    Restart Count:  0
    Environment:    &lt;none&gt;
    Mounts:         &lt;none&gt;
</code></pre>
<p>The app containers are in Waiting state with reason PodInitializing.</p>
<pre><code>Containers:
  app:
    Container ID:
    Port:           4000/TCP
    Host Port:      0/TCP
    State:          Waiting         &lt;---
      Reason:       PodInitializing &lt;---
    Ready:          False           &lt;---
</code></pre>
<p>At first we assumed that something is up with the init container, however it doesn't seem that way. Later we concluded that all pods which are stuck in Init state are on the same node. That explains the randomness of this issue.</p>
<p>Does anyone have any advice with this sort of issue?</p>
<p>Thank you,</p>
<p>Marko</p>

<p>If your initContainer is running and your regular container is in 'waiting' state it means that the initContainer is not exiting. From that perspective, it makes sense due to the fact that initContainers are supposed to <a href="https://kubernetes.io/docs/concepts/workloads/pods/init-containers/#understanding-init-containers" rel="nofollow noreferrer">exit/complete</a> and allow the regular container to start afterward. You should see something like this:</p>
<pre class="lang-yaml prettyprint-override"><code>Init Containers:
  istio-init:
    Container ID:  docker://bef731eae1eb3b6c9d926cacb497bb39a7d9796db49cd14a63014fc1a177d95b
    Image:         docker.io/istio/proxy_init:1.0.2
    Image ID:      docker-pullable://docker.io/istio/proxy_init@sha256:e16a0746f46cd45a9f63c27b9e09daff5432e33a2d80c8cc0956d7d63e2f9185
    .....
    State:          Terminated
      Reason:       Completed
    .....
    Ready:          True
</code></pre>
<p>So looks like <code>docker.io/istio/proxy_init:1.0.0</code> is not exiting in your case. I would check the logs:</p>
<pre class="lang-sh prettyprint-override"><code>kubectl logs &lt;pod-name&gt; -c istio-init
</code></pre>
<p>It could be that you have something unique issue in that node. Maybe your networking is not working(?), maybe your network overlay process has problems(?), are all the components from your <a href="https://istio.io/latest/docs/ops/deployment/architecture/" rel="nofollow noreferrer">Istio control plane</a> up and running(?), etc.</p>
<p>Looks like <a href="https://hub.docker.com/layers/istio/proxy_init/1.3.5-distroless/images/sha256-563936f73a4b6fb56672cd619049d7ff6e15a10c5e6fab0cf62499417547270d?context=explore" rel="nofollow noreferrer">proxy_init</a> container runs an <a href="https://github.com/istio/cni/blob/master/tools/packaging/common/istio-iptables.sh" rel="nofollow noreferrer">istio-iptables</a> script. You could also try changing that container/script to get more debug info if you'd like to pinpoint the exact problem.</p>
