<p>I am getting the following error while creating a gateway for the sample bookinfo application</p>

<blockquote>
  <p>Internal error occurred: failed calling admission webhook
  "pilot.validation.istio.io": Post
  <a href="https://istio-galley.istio-system.svc:443/admitpilot?timeout=30s" rel="nofollow noreferrer">https://istio-galley.istio-system.svc:443/admitpilot?timeout=30s</a>:
  Address is not allowed</p>
</blockquote>

<p>I have created a EKS poc cluster using two node-groups (each with two instances), one with t2.medium and another one is with t2.large type of instances in my dev AWS account using two subnets with /26 subnet with default VPC-CNI provided by EKS</p>

<p>But as the cluster is growing with multiple services running, I started facing issues of IPs not available (as per docs default vpc-cni driver treat pods as an EC2 instance)</p>

<p>to avoid same I followed following post to change networking from default to weave</p>

<p><a href="https://medium.com/codeops/installing-weave-cni-on-aws-eks-51c2e6b7abc8" rel="nofollow noreferrer">https://medium.com/codeops/installing-weave-cni-on-aws-eks-51c2e6b7abc8</a></p>

<p>because of same I have resolved IPs unavailability issue,</p>

<p>Now after network reconfiguration from vpc-cni to weave</p>

<p>I am started getting above issue as per subject line for my service mesh configured using Istio</p>

<p>There are a couple of services running inside the mesh and also integrated kiali, prometheus, jaeger with the same.</p>

<p>I tried to have a look at Github (<a href="https://github.com/istio/istio/issues/9998" rel="nofollow noreferrer">https://github.com/istio/istio/issues/9998</a>) and docs
(<a href="https://istio.io/docs/ops/setup/validation/" rel="nofollow noreferrer">https://istio.io/docs/ops/setup/validation/</a>), but could not get a proper valid answer.</p>

<p>Let me if anyone face this issue and have partial/full solution on this.</p>

<p>This 'appears' to be related to the switch from AWS CNI to weave. CNI uses the IP range of your VPC while weave uses its own address range (for pods), so there may be remaining iptables rules from AWS CNI, for example. </p>

<blockquote>
  <p>Internal error occurred: failed calling admission webhook "pilot.validation.istio.io": Post <a href="https://istio-galley.istio-system.svc:443/admitpilot?timeout=30s" rel="noreferrer">https://istio-galley.istio-system.svc:443/admitpilot?timeout=30s</a>: Address is not allowed</p>
</blockquote>

<p>The message above implies that whatever address <code>istio-galley.istio-system.svc</code> resolves to, internally in your K8s cluster, is not a valid IP address. So I would also try to see what that resolves to. (It may be related to <a href="https://coredns.io/" rel="noreferrer">coreDNS</a>).</p>

<p>You can also try the following <a href="https://github.com/weaveworks/weave/issues/3335#issuecomment-441522517" rel="noreferrer">these steps</a>;</p>

<p>Basically, (quoted)</p>

<ul>
<li>kubectl delete ds aws-node -n kube-system</li>
<li>delete /etc/cni/net.d/10-aws.conflist on each of the node</li>
<li>edit instance security group to allow UDP, TCP on 6873, 6874 ports</li>
<li>flush iptables, nat, mangle, filter</li>
<li>restart kube-proxy pods</li>
<li>apply weave-net daemonset</li>
<li>delete existing pods so the get recreated in Weave pod CIDR's address-space.</li>
</ul>

<p>Furthermore, you can try reinstalling everything from the beginning using weave.</p>

<p>Hope it helps!</p>
