Istio Ingress occasionally fails with ImagePullBackoff error

[metacoma]

$ kubectl -n istio-system get pods -l app=istio-ingressgateway
NAME                                   READY   STATUS             RESTARTS   AGE
istio-ingressgateway-9cc99c9db-4cxt8   0/1     ImagePullBackOff   0          14m

$ kubectl -n istio-system describe pod -l app=istio-ingressgateway | tail -n9
Events:
  Type     Reason     Age                 From               Message
  ----     ------     ----                ----               -------
  Normal   Scheduled  15m                 default-scheduler  Successfully assigned istio-system/istio-ingressgateway-9cc99c9db-4cxt8 to mcmp6
  Normal   Pulling    13m (x4 over 15m)   kubelet            Pulling image "auto"
  Warning  Failed     13m (x4 over 15m)   kubelet            Failed to pull image "auto": Error response from daemon: pull access denied for auto, repository does not exist or may require 'docker login': denied: requested access to the resource is denied
  Warning  Failed     13m (x4 over 15m)   kubelet            Error: ErrImagePull
  Warning  Failed     13m (x6 over 15m)   kubelet            Error: ImagePullBackOff
  Normal   BackOff    13s (x65 over 15m)  kubelet            Back-off pulling image "auto"

[metacoma]

Root cause:
The “auto” image is a place holder for the istio mutating webhhok. Once istiod is up the mutating webhook replaces the “auto” image with envoy that corresponds to the istiod version

https://discuss.istio.io/t/istio-ingressgateway-pods-tries-to-come-up-before-istiod-pods-and-fails-with-image-pull-error/15902/5

also:

argoproj/argo-cd#7437 (comment)

[metacoma]

The workaround in #27 should help, but there is no 100% guarantee that the problem is solved. To resolve this issue, ArgoCD needs to have dependencies between applications and resources. We are waiting for the PR argoproj/argo-cd#15280 to be merged.