On GKE with Istio, a Kubernetes NetworkPolicy, and mTLS enabled, HTTP requests from one Pod to another fail only for specific application URLs while other URLs succeed. What causes the failures?

The most likely cause for specific application URLs failing while others succeed, despite mTLS and NetworkPolicies, is an Istio AuthorizationPolicy. AuthorizationPolicies operate at the application layer (Layer 7) and can enforce fine-grained access control based on HTTP methods, paths, and headers. If a policy is configured to deny access to certain paths, requests to those paths will fail. Kubernetes NetworkPolicies operate at Layer 3/4 and would block all traffic between pods if misconfigured, not just specific URLs. Incorrect TCP ports would cause all requests to fail, not just specific URLs. While mTLS permissive mode issues can cause failures, they typically result in broader connectivity problems or specific authentication errors, not path-specific HTTP failures when other paths succeed.