An application in an Istio sidecar pod fails at startup because its first outbound calls happen before the Envoy sidecar is ready. Which setting fixes this?

Answer: holdApplicationUntilProxyStarts: true

Explanation

The containers in a pod start together, so the app can send traffic while Envoy has no configuration yet, and those requests fail. holdApplicationUntilProxyStarts, set mesh-wide in meshConfig.defaultConfig or per pod with the proxy.istio.io/config annotation, starts the sidecar first and holds the app until Envoy is ready. On clusters with native sidecar containers, Istio can also run the proxy as a native sidecar, which avoids the race.