<p>I have make my deployment work with istio ingressgateway before. I am not aware of any changes made in istio or k8s side.</p>
<p>When I tried to deploy, I see an error in replicaset side that's why it cannot create new pod.</p>
<blockquote>
<p>Error creating: Internal error occurred: failed calling webhook
&quot;namespace.sidecar-injector.istio.io&quot;: Post
&quot;https://istiod.istio-system.svc:443/inject?timeout=10s&quot;: dial tcp
10.104.136.116:443: connect: no route to host</p>
</blockquote>
<p>When I try to go inside api-server and ping 10.104.136.116 (istiod service IP) it just hangs.</p>
<p>What I have tried so far:</p>
<ul>
<li>Deleted all coredns pods</li>
<li>Deleted all istiod pods</li>
<li>Deleted all weave pods</li>
<li>Reinstalling istio via istioctl x uninstall --purge</li>
<li>turning all of VMs firewall</li>
<li>sudo iptables -P INPUT ACCEPT
sudo iptables -P FORWARD ACCEPT
sudo iptables -P OUTPUT ACCEPT
sudo iptables -F</li>
<li>restarted all of the nodes</li>
<li>manual istio pod injection</li>
</ul>
<p>Setup</p>
<ul>
<li>k8s version: 1.21.2</li>
<li>istio: 1.10.3</li>
<li>HA setup</li>
<li>CNI: weave</li>
<li>CRI: containerd</li>
</ul>

<p>In my case this was related to firewall. More info can be found <a href="https://istio.io/latest/docs/setup/platform-setup/gke/" rel="nofollow noreferrer">here</a>.</p>
<p>The gist of it is that on GKE at least you need to open another port 15017 in addition to 10250 and 443. This is to allow communication from your master node(s) to you VPC.</p>
