<p>I am attempting to install Istio 1.4.0 on a new GKE cluster. When I use the <a href="https://istio.io/docs/setup/install/helm/" rel="nofollow noreferrer">soon to be deprecated</a> Helm installation process, Istio works correctly and I can apply my own resources (gateways, deployments etc) without any issues, e.g.:</p>

<pre><code># Create namespace
kubectl create namespace istio-system

# Install Istio CRDs
helm template install/kubernetes/helm/istio-init --name istio-init --namespace istio-system | kubectl apply -f -

# Install Istio
helm template install/kubernetes/helm/istio --name istio --namespace istio-system \
  --set gateways.enabled=true \
  --set gateways.istio-ingressgateway.enabled=true \
  --set gateways.istio-ingressgateway.sds.enabled=true \
  --set gateways.istio-ingressgateway.externalTrafficPolicy="Local" \
  --set global.disablePolicyChecks=false \
  --set global.proxy.accessLogFile="/dev/stdout" \
  --set global.proxy.accessLogEncoding="TEXT" \
  --set grafana.enabled=true \
  --set grafana.security.enabled=true \
  --set kiali.enabled=true \
  --set prometheus.enabled=true \
  --set tracing.enabled=true \
  | kubectl apply -f -
</code></pre>

<p>However, when I attempt to install Istio using the <a href="https://istio.io/docs/setup/install/istioctl/#customizing-the-configuration" rel="nofollow noreferrer">istioctl</a> process, e.g.:</p>

<pre><code>istioctl manifest apply \
  --set values.gateways.enabled=true \
  --set values.gateways.istio-ingressgateway.enabled=true \
  --set values.gateways.istio-ingressgateway.sds.enabled=true \
  --set values.global.disablePolicyChecks=false \
  --set values.global.proxy.accessLogFile="/dev/stdout" \
  --set values.global.proxy.accessLogEncoding="TEXT" \
  --set values.grafana.enabled=true \
  --set values.grafana.security.enabled=true \
  --set values.kiali.enabled=true \
  --set values.prometheus.enabled=true \
  --set values.tracing.enabled=true
</code></pre>

<p>...I am unable to create resources as the <code>kubectl apply</code> command times out, e.g.:</p>

<pre><code>$ kubectl apply -f default-gateway.yaml
Error from server (Timeout): error when creating "default-gateway.yaml": Timeout: request did not complete within requested timeout 30s
</code></pre>

<p>This happens for every type of resource that I try to create. Has anyone else experienced something similar or is aware of what the underlying issue is?</p>

<p>Running <a href="https://istio.io/docs/ops/diagnostic-tools/istioctl-analyze/" rel="nofollow noreferrer">Istio analyze</a> does not reveal any issues:</p>

<pre><code>$ istioctl x analyze -k
✔ No validation issues found.
</code></pre>

<p><strong>-- Edit --</strong>  </p>

<p>Trying to run <code>busybox</code> also errors:</p>

<pre><code>$ kubectl run -i --tty busybox --image=busybox --restart=Never -- sh
Error from server (InternalError): Internal error occurred: failed calling webhook "sidecar-injector.istio.io": Post https://istio-sidecar-injector.istio-system.svc:443/inject?timeout=30s: net/http: request canceled while waiting for connection (Client.Timeout exceeded while awaiting headers)
</code></pre>

<p>I figured this out. The problem is the <code>istio-sidecar-injector</code> service and that I'm using a private GKE cluster which has more restrictive default firewall rules than a non-private cluster.</p>

<p>When installing Istio via the <a href="https://istio.io/docs/setup/install/helm/" rel="nofollow noreferrer">Helm process</a>, the <code>istio-sidecar-injector</code> service targets port <code>443</code>:</p>

<pre><code>$ kubectl get svc istio-sidecar-injector -n istio-system -o jsonpath='{.spec.ports[0]}'
map[name:https-inject port:443 protocol:TCP targetPort:443]
</code></pre>

<p>Port <code>443</code> is open by default on the <code>master</code> firewall rule (e.g. <code>gke-&lt;cluster-name&gt;-XXXXXXXX-master</code>), so the <code>istio-sidecar-injector</code> can operate successfully.</p>

<p>However, when installing Istio via the new <a href="https://istio.io/docs/setup/install/istioctl/" rel="nofollow noreferrer">Istioctl process</a>, the <code>istio-sidecar-injector</code> service targets port <code>9443</code> instead of <code>443</code>:</p>

<pre><code>~ $ kubectl get svc istio-sidecar-injector -n istio-system -o jsonpath="{.spec.ports[0]}"
map[port:443 protocol:TCP targetPort:9443]
</code></pre>

<p>This port is not open by default on the <code>master</code> firewall rule and is the cause of the timeout errors when trying to deploy resources, such as:</p>

<pre><code>$ kubectl run -i --tty busybox --image=busybox --restart=Never -- sh
Error from server (InternalError): Internal error occurred: failed calling webhook "sidecar-injector.istio.io": Post https://istio-sidecar-injector.istio-system.svc:443/inject?timeout=30s: net/http: request canceled while waiting for connection (Client.Timeout exceeded while awaiting headers)
</code></pre>

<p>After installing Istio, I opened port <code>9443</code> on the firewall like this:</p>

<pre><code>VPC_PROJECT=&lt;project containing VPC network&gt;
CLUSTER_NAME=&lt;name of the GKE cluster&gt;

FIREWALL_RULE_NAME=$(gcloud compute firewall-rules list --project $VPC_PROJECT --filter="name~gke-$CLUSTER_NAME-[0-9a-z]*-master" --format="value(name)")
gcloud compute firewall-rules update $FIREWALL_RULE_NAME --project $VPC_PROJECT --allow tcp:10250,tcp:443,tcp:9443
</code></pre>

<p>I was then able to create resources without error:</p>

<pre><code>$ kubectl run -i --tty busybox --image=busybox --restart=Never -- sh
If you don't see a command prompt, try pressing enter.
/ # ls
bin   dev   etc   home  proc  root  sys   tmp   usr   var
/ #
</code></pre>
