---
title: "The Proxy Died First: How Kubernetes Native Sidecars Solve the Service Mesh Shutdown Problem"
url: https://daily.dev/posts/the-proxy-died-first-how-kubernetes-native-sidecars-solve-the-service-mesh-shutdown-problem-2twpdjcpz
source_url: https://linkerd.io/2026/05/18/the-proxy-died-first
type: article
source: "Linkerd"
published: 2026-08-23T12:23:31.558Z
updated: 2026-08-23T12:54:37.413Z
tags: ["kubernetes", "infrastructure", "orchestration", "service-mesh"]
reading_time: 8
upvotes: 0
comments: 0
language: en
---

> ## Documentation Index
> Fetch the complete documentation index at: https://daily.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# The Proxy Died First: How Kubernetes Native Sidecars Solve the Service Mesh Shutdown Problem

**[Linkerd](https://daily.dev/sources/linkerd)** · 8 min read · 0 upvotes · 0 comments

## Summary

Kubernetes 1.33 brought Native Sidecar Containers (KEP-753) to general availability, solving the long-standing service mesh shutdown race condition where sidecar proxies like Linkerd's would exit before or during application container teardown, causing connection refused errors on in-flight requests. Setting restartPolicy: Always on an init container turns it into a native sidecar, guaranteeing deterministic startup order (proxy ready before app starts), ordered shutdown (proxy dies last, after app finishes draining), and automatic cleanup after Job completion. This eliminates old workarounds like preStop sleep hacks, Linkerd's waitBeforeExitSeconds config, postStart ordering tricks, and the linkerd-await wrapper binary for Jobs. Linkerd 2.15+ supports enabling native sidecar injection cluster-wide via Helm, and the pattern benefits any auxiliary container, including log collectors, database connection proxies, secret injection sidecars, and batch/ML workload sidecars.

## Full article

daily.dev links to this article rather than hosting it. Read it at the original source: <https://linkerd.io/2026/05/18/the-proxy-died-first>

## Questions this post answers

### How do Kubernetes native sidecar containers fix the service mesh connection refused error during pod shutdown?

Kubernetes 1.33 made native sidecar containers generally available, guaranteeing that regular application containers shut down first and sidecars like the Linkerd proxy stay running until they finish, eliminating the parallel SIGTERM teardown race that caused connection refused errors. You define this by setting restartPolicy: Always on an init container, turning it into a native sidecar that also starts before the app container.

_Track platform-level Kubernetes changes like this on daily.dev before they break your service mesh rollout._

### What was the linkerd-await tool used for and why can I remove it now?

linkerd-await was a wrapper binary added to Kubernetes Job entrypoints that waited for the Linkerd proxy to be ready, ran the actual workload, then called the proxy's admin shutdown endpoint so the pod could reach Succeeded instead of hanging forever. With native sidecars (GA in Kubernetes 1.33), Kubernetes automatically terminates the sidecar once the main container exits, so linkerd-await is no longer needed.

_Developers cleaning up mesh workarounds can follow platform migration guides like this via daily.dev._

### How do I enable native sidecar injection for Linkerd on Kubernetes 1.33?

Using Linkerd 2.15 or newer, native sidecar injection can be enabled cluster-wide through a Helm configuration option, which makes the proxy injector place the Linkerd proxy as a native sidecar init container instead of a regular container. Existing workloads automatically pick up the change on their next rollout, requiring no per-deployment configuration changes.

_daily.dev helps engineers stay current on Linkerd and Kubernetes upgrade steps like this one._

## Similar posts on daily.dev

- [Best of 2025: Kubernetes 1.33 Release Adds Native Support for Container Sidecars](https://daily.dev/posts/best-of-2025-kubernetes-1-33-release-adds-native-support-for-container-sidecars-16ndm59jo) · Cloud Native Now · 0 upvotes · 0 comments

---

Tags: [#kubernetes](https://daily.dev/tags/kubernetes), [#infrastructure](https://daily.dev/tags/infrastructure), [#orchestration](https://daily.dev/tags/orchestration), [#service-mesh](https://daily.dev/tags/service-mesh)

[View this post on daily.dev](https://daily.dev/posts/the-proxy-died-first-how-kubernetes-native-sidecars-solve-the-service-mesh-shutdown-problem-2twpdjcpz)