Traefik Mesh ClusterMesh Resource vs Pod Annotations: Sidecar Injection Mode Conflict

Injection Mode Conflict at the Pod Boundary

When deploying workloads into a Traefik Mesh cluster, the sidecar injection behavior is governed by a ClusterMesh resource that defines a cluster-wide or namespace-scoped policy. Individual pods can also carry mesh.* annotations that appear to request a specific injection mode. The documentation does not clearly state whether the ClusterMesh resource or the pod-level annotation wins when the two disagree, nor does it fully describe the default logic that selects between auto and manual injection.

This ambiguity matters most during incremental rollouts, where some teams rely on namespace policies and others annotate pods directly. Because Traefik Mesh version 1.7 changed the sidecar injection API, older clusters may resolve the conflict differently. Without a documented precedence rule, operators cannot predict whether a pod will receive a sidecar, skip injection, or fail to join the mesh.

Which injection strategy takes precedence when a pod annotation conflicts with the ClusterMesh resource policy? Does the precedence change between auto and manual modes, or across Traefik Mesh versions? Is there a supported way to make the effective injection decision observable before the pod is scheduled?