Failed to restart Pods with sidecar containers

[lucassus]

I have the following deployment that uses a sidecar container (https://kubernetes.io/docs/concepts/workloads/pods/sidecar-containers/):

  apiVersion: apps/v1
  kind: Deployment
  metadata:
    name: ***
    annotations:
      secrets.doppler.com/reload: "true"
  spec:
    replicas: 1
    selector:
      matchLabels:
        app.kubernetes.io/name: web
        app.kubernetes.io/instance: release-name
    template:
      spec:
        serviceAccountName: ***
        restartPolicy: Always
        terminationGracePeriodSeconds: 30
        initContainers:
          # Native sidecar container, see https://kubernetes.io/blog/2023/08/25/native-sidecar-containers/
          - name: haproxy-redis-sidecar
            image: haproxy:3.0.5
            imagePullPolicy: IfNotPresent
            restartPolicy: Always
            args: ["-V", "-f", "/usr/local/etc/haproxy/haproxy.cfg"]
            volumeMounts:
              - name: haproxy-redis-cfg
                mountPath: /usr/local/etc/haproxy/haproxy.cfg
            readinessProbe:
              exec:
                command: ["cat", "/dev/null"]
              initialDelaySeconds: 5
              periodSeconds: 5
              timeoutSeconds: 5
              successThreshold: 1
              failureThreshold: 3
        containers:
        - name: ab
          envFrom:
            # Load environment variables from the Doppler
            - secretRef:
                name: ***
          ....

For some reason Doppler Operator can't sync secrets for this deployment.
I have lots of errors like:

2025-01-20T16:16:34.906Z	ERROR	controllers.DopplerSecret	Unable to reconcile deployment	{"dopplersecret": "doppler-operator-system/***", "error": "Failed to update deployment annotation: Deployment.apps \"web-***\" is invalid: spec.template.spec.initContainers[0].readinessProbe: Forbidden: may not be set for init containers without restartPolicy=Always"}

[nmanoogian]

Thanks for reporting this, @lucassus! We'll take a look