<p>we are testing out the Ambassador Edge Stack and started with a brand new GKE private cluster in autopilot mode.</p>
<p>We installed from scratch following the quick start tour to get a feeling of it and ended up with the following error</p>
<pre><code>Error from server: error when creating &quot;mapping-test.yaml&quot;: conversion webhook for getambassador.io/v3alpha1, Kind=Mapping failed: Post &quot;https://emissary-apiext.emissary-system.svc:443/webhooks/crd-convert?timeout=30s&quot;: net/http: request canceled while waiting for connection (Client.Timeout exceeded while awaiting headers)
</code></pre>
<p>We did a few rounds of DNS testing and deployed a few different test pods in different namespaces to validate that kube-dns is working properly, everything looks good at that end. Also the resolv.conf looks good.</p>
<p>Ambassador is using the hostname <code>emissary-apiext.emissary-system.svc:443</code> (without the cluster.local) which should resolve fine. Doing a lookup with the FQN (with cluster.local) works fine btw.</p>
<p>Any clues?</p>
<p>Thanks a lot and take care.</p>

<p>I think i found the solution, posting here if someone come across this later on.</p>
<p>So i followed <a href="https://www.getambassador.io/docs/edge-stack/latest/tutorials/getting-started/" rel="noreferrer">this</a> to deploy Ambassador Edge Stack in a Autopilot private cluster. I was getting the same error when i was trying to deploy the Mapping object (step 2.2).</p>
<p>The issue is that the control plane (API Server) is trying to call emissary-apiext.emissary-system.svc:443 but the pods behind it are listening on port 8443 (figured that out by describing the Service).</p>
<p>So i added a firewall rule to allow the GKE control plane to talk to the nodes on port 443.</p>
<p>The firewall rule in question is called <strong>gke-gke-ap-xxxxx-master</strong>. The xxxx is called the cluster hash and is different for each cluster. To make sure you are editing the proper rule, double check that source IP Range matches the &quot;Control plane address range&quot; from the cluster details page. And that it's the rule that has a name ending with master.</p>
<p>Just edit that rule and add 8443 to the tcp ports. It should work</p>
