Istio would not inject the side-car into a namespace labeled for the injection, for example: a redeployment would fail when forced: the istio-init would fail, as seen in the logs of the pod: with a really sparse Error output: Fortunately, the very container info is a bit more verbose: So, an IPTables-related issue, after all? Yes, RockyLinux, used for this …