<p>I have been trying to set up Istio on my existing GKE cluster.</p>
<p>I hev followed the steps mentioned on the Istio website for the installation - prerequisite.</p>
<p><a href="https://istio.io/latest/docs/setup/platform-setup/gke/" rel="nofollow noreferrer">https://istio.io/latest/docs/setup/platform-setup/gke/</a></p>
<p>I have a private cluster so I added the firewall rule mention in the prerequisite.</p>
<pre><code>gke-aiq-kubernetes-0a227ee8-all               default  INGRESS    1000      tcp,udp,icmp,esp,ah,sctp            False
gke-aiq-kubernetes-0a227ee8-master            default  INGRESS    1000      tcp:10250,tcp:443,tcp:15017         False
gke-aiq-kubernetes-0a227ee8-vms               default  INGRESS    1000      tcp:1-65535,udp:1-65535,icmp        False
</code></pre>
<p>and then install the istio with the demo profile.</p>
<pre><code>istioctl install --set profile=demo
</code></pre>
<p>and then verify the intallation</p>
<pre><code>istioctl verify-install
</code></pre>
<p>Which says everything is succeeded.</p>
<p>I labeled by namecpace &quot;instio-inject=enabled&quot; so that I will automatically get the sidecar porxy injected.</p>
<p>But when I trying to deploy something in the namespace I am getting following error:</p>
<pre><code>Error from server (InternalError): error when creating &quot;pod-pending.yaml&quot;: Internal error occurred: failed calling webhook &quot;sidecar-injector.istio.io&quot;: Post https://istiod.istio-system.svc:443/inject?timeout=30s: context deadline exceeded
</code></pre>
<p>What I understand from this is that there is some connectivity issue, but I am not sure how to debug this.</p>
<p>I tried the debugging page from istio:</p>
<p><a href="https://github.com/istio/istio/wiki/Troubleshooting-Istio#diagnostics" rel="nofollow noreferrer">https://github.com/istio/istio/wiki/Troubleshooting-Istio#diagnostics</a></p>
<p>and after running the command:</p>
<pre><code>kubectl get --raw /api/v1/namespaces/istio-system/services/https:istiod:https-webhook/proxy/inject -v4
</code></pre>
<p>I am conformend that this is connectivity issue:</p>
<pre><code>t -v5
I1113 23:20:11.241079   40356 helpers.go:199] server response object: [{
  &quot;metadata&quot;: {},
  &quot;status&quot;: &quot;Failure&quot;,
  &quot;message&quot;: &quot;the server is currently unable to handle the request&quot;,
  &quot;reason&quot;: &quot;ServiceUnavailable&quot;,
  &quot;details&quot;: {
    &quot;causes&quot;: [
      {
        &quot;reason&quot;: &quot;UnexpectedServerResponse&quot;,
        &quot;message&quot;: &quot;Error trying to reach service: 'dial tcp 10.48.3.25:15017: i/o timeout'&quot;
      }
    ]
  },
  &quot;code&quot;: 503
}]
F1113 23:20:11.241367   40356 helpers.go:114] Error from server (ServiceUnavailable): the server is currently unable to handle the request

</code></pre>
<p>Need help, I am new to GKE.</p>

Vaibhav Jain
<p>I figured out the issue.</p>
<p>I have 7 different GCP projects configured with my gcloud profile and I was in a different project while running the gcloud command. (all gke clusters have the same name)</p>
<p><strong>Steps from the command line:</strong></p>
<p>I logged in to the GCP UI from the browser search the firewall under VPC and opened the ports manually there and it worked.</p>
<pre><code>gcloud compute firewall-rules list --filter=&quot;name~gke-&lt;clustername&gt;-[0-9a-z]*-master&quot;
</code></pre>
<p>Then get the firewall rule name.</p>
<pre><code>gcloud compute firewall-rules update &lt;firewall rule name&gt; --allow tcp:10250,tcp:443,tcp:15017
</code></pre>
<p>The idea here is to add the <strong>tcp:15017</strong> which is required by the admission hook.</p>
