What you should not do
Default sidecar resources in prod: 1Gi limit OOMs
in large meshes without Sidecar scoping, 100m CPU
request under-reserves at high RPS.
Mesh VirtualService without a Sidecar resource:
every sidecar gets every rule, push storm.
STRICT without migration:
non-injected workloads break (jobs, external health checks).
EnvoyFilter as the default tool: reach for the
Telemetry API, AuthorizationPolicy, TrafficExtension
(1.30+, v1alpha1; Wasm + Lua) or WasmPlugin first.
EnvoyFilter breaks between minors.
Multi-cluster without a shared root CA: mTLS fails.