native sidecar drains immediately

Is this the right place to submit this?

• This is not a security vulnerability or a crashing bug
• This is not a question about how to use Istio

Bug Description

We tried switching to native sidecars via the sidecar.istio.io/nativeSidecar: "true" pod annotation. While this worked to the extent that it did in fact create a native sidecar, istio-proxy misbehaves during shutdown, negating the entire point.

In particular, our main app sleeps a few seconds upon SIGTERM, to give time for the pod to be deregistered from EndpointSlice, as per Kubernetes best practices. However, when I deleted the pod in question, I immediately observed the following log from the istio-proxy sidecar:

info handling /drain, starting drain

This means that istio-proxy is immediately draining for some reason, instead of waiting for the main application to exit like it's supposed to.

Version

$ istioctl version
client version: 1.28.5
control plane version: 1.28.5
data plane version: 1.28.5 (120 proxies)

Additional Information

No response