<p>I am new to Kubernetes, Istio and so on, so please be gentle :)</p>
<p>I have minikube running, I can deploy services and they run fine.
I have installed istio following this guide:
<a href="https://istio.io/latest/docs/setup/install/istioctl/" rel="nofollow noreferrer">https://istio.io/latest/docs/setup/install/istioctl/</a></p>
<p>If I tag the default namespace with</p>
<pre><code>kubectl label namespace default istio-injection=enabled
</code></pre>
<p>the deployment fails. The service is green on the minikube dashboard, but the pod doesn't start up.</p>
<pre><code>Ready: false
Started: false
Reason: PodInitializing
</code></pre>
<p>Here are a couple of print screens from the dashboard:</p>
<p><a href="https://i.stack.imgur.com/o13fz.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/o13fz.png" alt="enter image description here" /></a></p>
<p><a href="https://i.stack.imgur.com/c7nY7.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/c7nY7.png" alt="enter image description here" /></a></p>
<p>This is clearly related to istio.
If I remove the istio tag from the namespace, the deployment works and the pod starts.</p>
<p>Any help would be greatly appreciated.</p>
<p><strong>EDIT</strong></p>
<p>Running</p>
<pre><code>kubectl logs mypod-bd48d6bcc-6wcq2 -c istio-init
</code></pre>
<p>prints out</p>
<pre><code>2022-08-24T14:07:15.227238Z info    Istio iptables environment:
ENVOY_PORT= 
INBOUND_CAPTURE_PORT= 
ISTIO_INBOUND_INTERCEPTION_MODE= 
ISTIO_INBOUND_TPROXY_ROUTE_TABLE= 
ISTIO_INBOUND_PORTS=
ISTIO_OUTBOUND_PORTS=
ISTIO_LOCAL_EXCLUDE_PORTS=
ISTIO_EXCLUDE_INTERFACES=
ISTIO_SERVICE_CIDR=
ISTIO_SERVICE_EXCLUDE_CIDR=
ISTIO_META_DNS_CAPTURE=
INVALID_DROP=

2022-08-24T14:07:15.229791Z info    Istio iptables variables:
PROXY_PORT=15001
PROXY_INBOUND_CAPTURE_PORT=15006
PROXY_TUNNEL_PORT=15008
PROXY_UID=1337
PROXY_GID=1337
INBOUND_INTERCEPTION_MODE=REDIRECT
INBOUND_TPROXY_MARK=1337
INBOUND_TPROXY_ROUTE_TABLE=133
INBOUND_PORTS_INCLUDE=*
INBOUND_PORTS_EXCLUDE=15090,15021,15020
OUTBOUND_OWNER_GROUPS_INCLUDE=*
OUTBOUND_OWNER_GROUPS_EXCLUDE=
OUTBOUND_IP_RANGES_INCLUDE=*
OUTBOUND_IP_RANGES_EXCLUDE=
OUTBOUND_PORTS_INCLUDE=
OUTBOUND_PORTS_EXCLUDE=
KUBE_VIRT_INTERFACES=
ENABLE_INBOUND_IPV6=false
DNS_CAPTURE=false
DROP_INVALID=false
CAPTURE_ALL_DNS=false
DNS_SERVERS=[],[]
OUTPUT_PATH=
NETWORK_NAMESPACE=
CNI_MODE=false
EXCLUDE_INTERFACES=

2022-08-24T14:07:15.232249Z info    Writing following contents to rules file: /tmp/iptables-rules-1661350035231776045.txt1561657352
* nat
-N ISTIO_INBOUND
-N ISTIO_REDIRECT
-N ISTIO_IN_REDIRECT
-N ISTIO_OUTPUT
-A ISTIO_INBOUND -p tcp --dport 15008 -j RETURN
-A ISTIO_REDIRECT -p tcp -j REDIRECT --to-ports 15001
-A ISTIO_IN_REDIRECT -p tcp -j REDIRECT --to-ports 15006
-A PREROUTING -p tcp -j ISTIO_INBOUND
-A ISTIO_INBOUND -p tcp --dport 15090 -j RETURN
-A ISTIO_INBOUND -p tcp --dport 15021 -j RETURN
-A ISTIO_INBOUND -p tcp --dport 15020 -j RETURN
-A ISTIO_INBOUND -p tcp -j ISTIO_IN_REDIRECT
-A OUTPUT -p tcp -j ISTIO_OUTPUT
-A ISTIO_OUTPUT -o lo -s 127.0.0.6/32 -j RETURN
-A ISTIO_OUTPUT -o lo ! -d 127.0.0.1/32 -m owner --uid-owner 1337 -j ISTIO_IN_REDIRECT
-A ISTIO_OUTPUT -o lo -m owner ! --uid-owner 1337 -j RETURN
-A ISTIO_OUTPUT -m owner --uid-owner 1337 -j RETURN
-A ISTIO_OUTPUT -o lo ! -d 127.0.0.1/32 -m owner --gid-owner 1337 -j ISTIO_IN_REDIRECT
-A ISTIO_OUTPUT -o lo -m owner ! --gid-owner 1337 -j RETURN
-A ISTIO_OUTPUT -m owner --gid-owner 1337 -j RETURN
-A ISTIO_OUTPUT -d 127.0.0.1/32 -j RETURN
-A ISTIO_OUTPUT -j ISTIO_REDIRECT
COMMIT
2022-08-24T14:07:15.232504Z info    Running command: iptables-restore --noflush /tmp/iptables-rules-1661350035231776045.txt1561657352
2022-08-24T14:07:15.256253Z error   Command error output: xtables parameter problem: iptables-restore: unable to initialize table 'nat'

Error occurred at line: 1
Try `iptables-restore -h' or 'iptables-restore --help' for more information.
2022-08-24T14:07:15.256845Z error   Failed to execute: iptables-restore --noflush /tmp/iptables-rules-1661350035231776045.txt1561657352, exit status 2
</code></pre>

<p>This might help you:</p>
<p>I am having same error in injected container istio-init.</p>
<p>My system is : k8s 1.26 and istio 1.17.1, installed on rocky 8.5 stations.</p>
<p>This solved my problem:</p>
<p>1.</p>
<pre><code>cat &lt;&lt;EOT &gt;&gt; /etc/modules-load.d/k8s.conf
overlay
br_netfilter
nf_nat
xt_REDIRECT
xt_owner
iptable_nat
iptable_mangle
iptable_filter
EOT
</code></pre>
<ol start="2">
<li></li>
</ol>
<pre><code>modprobe br_netfilter ; modprobe nf_nat ; modprobe xt_REDIRECT ; modprobe xt_owner; modprobe iptable_nat; modprobe iptable_mangle; modprobe iptable_filter
</code></pre>
<p>I got this solution from:
<a href="https://github.com/istio/istio/issues/23009" rel="nofollow noreferrer">enter link description here</a></p>
