<p>I have successfully installed Istio in k8 cluster.</p>
<ul>
<li><p>Istio version is 1.9.1</p>
</li>
<li><p>Kubernetes CNI plugin used: Calico version 3.18 (Calico POD is up and running)</p>
</li>
</ul>
<pre><code>kubectl get pod -A

istio-system           istio-egressgateway-bd477794-8rnr6           1/1     Running   0          124m
istio-system           istio-ingressgateway-79df7c789f-fjwf8        1/1     Running   0          124m
istio-system           istiod-6dc55bbdd-89mlv                       1/1     Running   0          124

</code></pre>
<p>When I'm trying to deploy sample nginx app I am getting the error below:</p>
<pre><code>failed calling webhook sidecar-injector.istio.io context deadline exceeded
Post &quot;https://istiod.istio-system.svc:443/inject?timeout=30s&quot;: 
context deadline exceeded
</code></pre>
<p>When I Disable automatic proxy sidecar injection the pod is getting deployed without any errors.</p>
<pre><code>kubectl label namespace default istio-injection-
</code></pre>
<p>I am not sure how to fix this issue could you please some one help me on this?</p>

Gowmi
<p>In this case, adding <code>hostNetwork:true</code> under <code>spec.template.spec</code> to the <code>istiod</code> Deployment may help.
This seems to be a workaround when using Calico CNI for pod networking (see: <a href="https://github.com/istio/istio/issues/20890#issuecomment-711051999" rel="nofollow noreferrer">failed calling webhook &quot;sidecar-injector.istio.io</a>)</p>
<p>As we can find in the <a href="https://kubernetes.io/docs/concepts/policy/pod-security-policy/#host-namespaces" rel="nofollow noreferrer">Kubernetes Host namespaces documentation</a>:</p>
<blockquote>
<p>HostNetwork - Controls whether the pod may use the node network namespace. Doing so gives the pod access to the loopback device, services listening on localhost, and could be used to snoop on network activity of other pods on the same node.</p>
</blockquote>
