<p>I had istio configured but without the CNI addon enabled.</p>
<p>In that time, I had an init container with a service account that would call the Kubernetes API to verify a couple of things (via kubectl).</p>
<p>Since I enabled the CNI addon, this init container fails with the following message:</p>
<blockquote>
<p>The connection to the server 10.23.64.1:443 was refused - did you specify the right host or port?</p>
</blockquote>
<p>I tried removing all my network policies to see if that was the issue, but same result.
I also gave the service account that this pods uses the cluster-admin role, but it didn't do the trick.</p>
<p>I tested with both 1.6 and 1.7 branches of Istio.</p>
<p>What is the issue here? Other pods without this init container work fine.</p>

<p>In order to have init container network connectivity with istio cni enabled please follow the guide for a workaround from istio <a href="https://istio.io/latest/docs/setup/additional-setup/cni/#compatibility-with-application-init-containers" rel="nofollow noreferrer">documentation</a>:</p>
<blockquote>
<h3>Compatibility with application init containers<a href="https://istio.io/latest/docs/setup/additional-setup/cni/#compatibility-with-application-init-containers" rel="nofollow noreferrer"></a></h3>
<p>The Istio CNI plugin may cause networking connectivity problems for any application  <code>initContainers</code>. When using Istio CNI,  <code>kubelet</code>  starts an injected pod with the following steps:</p>
<ol>
<li>The Istio CNI plugin sets up traffic redirection to the Istio sidecar proxy within the pod.</li>
<li>All init containers execute and complete successfully.</li>
<li>The Istio sidecar proxy starts in the pod along with the pod’s other containers.</li>
</ol>
<p>Init containers execute before the sidecar proxy starts, which can result in traffic loss during their execution. Avoid this traffic loss with one or both of the following settings:</p>
<ul>
<li>Set the  <code>traffic.sidecar.istio.io/excludeOutboundIPRanges</code>  annotation to disable redirecting traffic to any CIDRs the init containers communicate with.</li>
<li>Set the  <code>traffic.sidecar.istio.io/excludeOutboundPorts</code>  annotation to disable redirecting traffic to the specific outbound ports the init containers use.</li>
</ul>
</blockquote>
