Kubernetes Sidecar Injection Silently Fails When Label Is Applied to Wrong Target

A common Kubernetes mistake involves running kubectl label on a Deployment object, which updates the Deployment's own metadata rather than its pod template spec. Because sidecar injection relies on a mutating admission webhook that matches pod-level labels, and pods inherit labels only from the pod template, the webhook never fires. The Deployment reports success, no rollout is triggered, and existing pods continue running without a sidecar — all without any error or warning. The correct fix is to patch the label directly into spec.template.metadata.labels, which triggers a rollout and ensures new pods carry the label through the webhook. Engineers can verify the fix by confirming pods show a container count of 2/2 after the rollout completes.