The following options in SMCP.spec.istio.global.proxy aren't propagated to the application pods:

• statusPort
• includeIPRanges
• excludeIPRanges
• excludeInboundPorts
• excludeOutboundPorts

When you use istioctl kube-inject, these options get injected via traffic.sidecar.istio.io annotations, but when using only the sidecar-injector webhook, those annotations don't get added to the pod.

As a workaround, users must manually set the annotations on each of their pods.