kubernetes 443 connection error when request is initated by pod

[a-devops-guy]

kubernetes 443 connection error when request is initated by pod which has istio envoy sidecar.

kubectl --kubeconfig kubeconfig.yaml logs -f ezto-minio-ezto-minio-0 -n ezto -c validate-arguments
2024/03/10 17:17:11 validator.go:86: Get "https://10.152.183.1:443/apis/minio.min.io/v2/namespaces/ezto/tenants/ezto-minio": dial tcp 10.152.183.1:443: connect: connection refused
2024/03/10 17:17:11 validator.go:63: Get "https://10.152.183.1:443/apis/minio.min.io/v2/namespaces/ezto/tenants/ezto-minio": dial tcp 10.152.183.1:443: connect: connection refused

kubectl --kubeconfig kubeconfig.yaml version                                                      
Client Version: v1.29.1
Kustomize Version: v5.0.4-0.20230601165947-6ce0bf390ce3
Server Version: v1.29.2

istioctl --kubeconfig kubeconfig.yaml version
client version: 1.20.3
control plane version: 1.22-alpha.503c3c25acece2826d11f2cfcb0a1de58d310bf8
data plane version: 1.22-alpha.2c8dcd45a39964c6270653acd7605427004cae2e (6 proxies), 1.22-alpha.503c3c25acece2826d11f2cfcb0a1de58d310bf8 (3 proxies)

istio is configured to allow all traffic no blocks no servicentry or sidecar is configured. just the default. and pod has below annotations

    traffic.sidecar.istio.io/excludeInboundPorts: "15020"
    traffic.sidecar.istio.io/includeInboundPorts: '*'
    traffic.sidecar.istio.io/includeOutboundIPRanges: '*'

[a-devops-guy]

fixed it as per #23802

added annotations to traffic.sidecar.istio.io/excludeOutboundPorts: "443" or remove the istio cni and control traffic via sidecar if needed