<p>Kubernetes version: 1.17.14-gke.400</p>
<p>I am having trouble creating pods with istio setup, I am getting a timeout error from the sidecar injector.</p>
<p>I setup istio (1.8.1) with this command:</p>
<pre><code>istioctl install --set profile=minimal \
 --set values.cni.cniBinDir=/home/kubernetes/bin \
 --set 'values.cni.excludeNamespaces[0]'=kube-system \
 --set 'values.cni.excludeNamespaces[1]'=istio-system \
 --set 'values.cni.excludeNamespaces[2]'=backend \
 --set components.cni.enabled=true \
 --set components.cni.namespace=kube-system
</code></pre>
<p>Then when I try to deploy the sleep sample I get one of these two errors
<code>kubectl apply -f samples/sleep/sleep.yaml</code></p>
<pre><code>Error creating: Internal error occurred: failed calling webhook &quot;sidecar-injector.istio.io&quot;: Post https://istiod.istio-system.svc:443/inject?timeout=30s: context deadline exceeded
</code></pre>
<p>or</p>
<pre><code>Error creating: Internal error occurred: failed calling webhook &quot;sidecar-injector.istio.io&quot;: Post https://istiod.istio-system.svc:443/inject?timeout=30s: net/http: request canceled while waiting for connection (Client.Timeout exceeded while awaiting headers)
</code></pre>
<p>I do have network policies enabled, but I don't have any setup in kube-system of istio-system. Also, when I curl that endpoint I get a 400 error.</p>

Michael St Clair
<p>My issue turned out to be that I needed to update the firewall rule to add port 15017 even though I do not have a private cluster: <a href="https://istio.io/latest/docs/setup/platform-setup/gke/" rel="nofollow noreferrer">https://istio.io/latest/docs/setup/platform-setup/gke/</a></p>
