Thanks for the response. The firewall is disabled on both of the nodes in the cluster and as far as I know there's no local firewall on the pods. I have no network policies either when I run "kubectl get networkpolicies --all-namespaces".

Pod to pod connectivity seems fine but when trying to reach a service cluster IP using curl or telnet from a pod, the connection times out or can't connect. I previously had a similar error but related to dns and ultimately no dns was working in the cluster despite the core-dns deployment/pods/services being healthy/set up correctly. This was solved by switching to iptables-legacy from iptables-nft on the cluster nodes.

I was/am thinking this issue I have now is related/a follow on from the dns issue(?) and is to do with iptables on the nodes. I have the kube-proxy ConfigMap mode set to iptables. I've checked the ip tables and ipset list on the nodes and I think it looks like it should work but wouldn't mind a second set of eyes.

Now I'm not sure... but it does seem to be the 'no connectivity from pod network to service network' that is the issue...

Any help greatly appreciated.

Thanks

I think this is more a Kubernetes network issue rather than Istio related, I just happened to notice the issue when setting up Istio.

Although it seems that pods cannot communicate (telnet and curl) with services, they can communicate with the kube-dns service. Therefore pod to service network is possible, it just doesn't work for any service other than kube-dns. It must be a routing issue, I just can't figure out what that issue is

It sort of makes sense for pods to not be able to access services. Of course, the service relevant to the pod(s) needs to access the pods, and all the pods need to access the kube-dns service, but there's no default reason for pods to be able to access other services except for this.