The istio-cni code that monitors configuration files for changes - so it can reinstall the necessary files - has changed from 2.1 to 2.2. It now monitors the bin directory in addition to the conf directory.

Because our pod comes with various containers, and each of them touch the same directory, the watcher is triggered all the time, meaning containers race to reinstall their files, which trigger the watch again...

This results in high CPU load in the node, and sometimes it prevent the copy of the binaries to succeed.