Try checking if communication between nodes and eks control plane is open on port 15017. In my case i had to open this port on ingress in node security group. Those curls you tested proves that communication between nodes is possible, istio in order to create sidecar needs to be able to communicate with hook and for that network passage to EKS master is needed.
I am getting the exact same issue:
Istio 1.17.2 installed with
istioctl install --set values.gateways.istio-ingressgateway.type=NodePort
k get po -n istio-system
NAME READY STATUS RESTARTS AGE
istio-egressgateway-85649899f8-6wd7c 1/1 Running 0 14h
istio-ingressgateway-f56888458-tlbsf 1/1 Running 0 14h
istiod-64848b6c78-tqqff 1/1 Running 0 14h
symptom appears when trying to deploy a RS to a istio-injection labeled NS:
Error creating: Internal error occurred: failed calling webhook "namespace.sidecar-injector.istio.io": failed to call webhook: Post "https://istiod.istio-system.svc:443/inject?timeout=10s": context deadline exceeded
The same diagnostics as the original post:
kubectl get --raw /api/v1/namespaces/istio-system/services/https:istiod:https-webhook/proxy/inject -v4
"message": "error trying to reach service: dial tcp 10.0.0.21:15017: connect: connection timed out",
Error from server (ServiceUnavailable): error trying to reach service: dial tcp 10.0.0.21:15017: connect: connection timed out
I also get the same results for the curl command for pods on the same node/same namespace and for pods on different nodes on different namespaces.
curl https://istiod.istio-system.svc:443/inject -k
no body found
I have opened the ingress to the node sg and the acls on the subnets look ok.
Is there something else to try ?
Has anyone found the fix for this on EKS ?