Temporal Helm schema Job containers fail with Istio STRICT mTLS

Expected Behavior

The Temporal Helm chart schema Job should work in Kubernetes clusters with Istio sidecar injection and STRICT mTLS enabled.

When schema setup/update is enabled, the Job should either:

• run schema setup after the Istio sidecar is ready, or
• provide a chart-supported way to run schema setup/update as normal containers instead of init containers

Actual Behavior

The chart renders schema setup/update as init containers in the temporal-schema-* Job.

In an Istio STRICT mTLS namespace, those init containers try to connect to the SQL database before the istio-proxy sidecar is running. Because application containers, including the sidecar, do not start until init containers complete, the schema init container cannot establish the mTLS-protected connection to Postgres.

Steps to Reproduce the Problem

Deploy the Temporal Helm chart into a namespace with Istio sidecar injection enabled and STRICT mTLS enforced.
Configure Temporal persistence to use an in-cluster Postgres service that is reachable only through the Istio mesh / mTLS path.
Enable schema setup/update in the Helm chart and install/upgrade the release.

Specifications

Version: Temporal Helm chart 0.73.2, Temporal server/admin-tools 1.30.2
Platform: OpenShift/Kubernetes with Istio sidecar injection and STRICT mTLS enabled, Postgres persistence using postgres12 driver.

Start with the Temporal Helm chart templates that render the temporal-schema-* Job and its schema setup/update init containers. Reproduce the install or upgrade in a Kubernetes namespace with Istio sidecar injection and STRICT mTLS, then verify that schema setup can connect to the in-cluster Postgres service before the Job completes.