Multicluster setup error: "validationController Not ready to switch validation to fail-enclosed" "failed calling webhook ''"


I tried to follow the instructions for Istio multicluster installation in same network. I followed the instructions in “before you begin”. I used instructions in “Plug-in CA certificate” page. During verification of the root certificate installation process, there was a warning “Root CA verify error.num=19” and “command terminated with exit code=1” when retrieving the certificate chain. I assumed this is ok.

I used profile=demo to install istio. After successful verification of root certificate, i went directly to the endpoint discovery step in multicluster installation instruction in Istio / Install Multi-Primary. At this point i am getting the error from the logs of istiod -
“validationController Not ready to switch validation to fail-closed: dummy invalid rejected for the wrong reason: Internal error occurred: failed calling webhook “”: failed to call webhook: Post “http://istiod.istio-system.svc:443/validate?timeout=10s”: dial tcs connect: no route to host”.

Can someone please help?