<p>I'm using a Kubernetes/Istio setup and my list of pods and services are as below:</p>

<pre><code>NAME                                                READY     STATUS    RESTARTS   AGE
hr--debug-deployment-86575cffb6-wl6rx               2/2       Running   0          33m
hr--hr-deployment-596946948d-jrd7g                  2/2       Running   0          33m

NAME                             TYPE        CLUSTER-IP       EXTERNAL-IP   PORT(S)             AGE
hr--debug-service                ClusterIP   10.104.160.61    &lt;none&gt;        80/TCP              33m
hr--hr-service                   ClusterIP   10.102.117.177   &lt;none&gt;        80/TCP              33m
</code></pre>

<p>I'm attempting to curl into <code>hr--hr-service</code> from <code>hr--debug-deployment-86575cffb6-wl6rx</code></p>

<pre><code>pasan@ubuntu:~/product-vick$ kubectl exec -it hr--debug-deployment-86575cffb6-wl6rx /bin/bash
Defaulting container name to debug.
Use 'kubectl describe pod/hr--debug-deployment-86575cffb6-wl6rx -n default' to see all of the containers in this pod.
root@hr--debug-deployment-86575cffb6-wl6rx:/# curl hr--hr-service -v
* Rebuilt URL to: hr--hr-service/
*   Trying 10.102.117.177...
* Connected to hr--hr-service (10.102.117.177) port 80 (#0)
&gt; GET / HTTP/1.1
&gt; Host: hr--hr-service
&gt; User-Agent: curl/7.47.0
&gt; Accept: */*
&gt;
&lt; HTTP/1.1 403 Forbidden
&lt; date: Thu, 03 Jan 2019 04:06:17 GMT
&lt; server: envoy
&lt; content-length: 0
&lt;
* Connection #0 to host hr--hr-service left intact
</code></pre>

<p>Can you please explain why I'm getting a 403 forbidden by envoy and how I can troubleshoot it?</p>

Pasan W.
<p>If you have the envoy sidecar injected it really depends on what type of <a href="https://istio.io/docs/concepts/security/#authentication-policies" rel="nofollow noreferrer">authentication policy</a> you have between your services. Are you using a <code>MeshPolicy</code> or a <code>Policy</code>?</p>

<p>You can also try disabling authentication between your services to debug. Something like this (if your policy is defined like this):</p>

<pre><code>apiVersion: "authentication.istio.io/v1alpha1"
kind: "Policy"
metadata:
  name: "hr--hr-service"
spec:
  targets:
  - name: hr--hr-service
  peers:
  - mTLS:
      mode: PERMISSIVE
</code></pre>
