trouble with route to api

[klarmina]

Problem: Unable to deploy Argo CD in Kubernetes due to a persistent no route to host error when pods attempt to reach the Kubernetes API at 10.233.0.1:443.

Environment:

• CNI: Calico (with vxlanMode: Always enabled).
• Cluster: Bare metal / virtual machines (master node + worker nodes).
• Application: Argo CD (installed using the official Helm chart).

Symptoms:

Pre-installation hooks (argocd-redis-secret-init) and the main controller/server pods (argocd-server, argocd-application-controller) fail with logs such as:

{"error":"failed to list *v1.Secret: Get \"https://10.233.0.1:443/api/v1/namespaces/argocd/secrets...\": dial tcp 10.233.0.1:443: connect: no route to host"}

At the same time, network connectivity to the API server from the hosts themselves works normally (nc succeeds). The problem appears to occur specifically at the packet-routing level for traffic originating from containers/pods through the Calico network interface (vxlan.calico).

What has already been checked / attempted:

• Verified and confirmed that net.ipv4.ip_forward = 1 is enabled.
• Explicitly configured the Calico node interface autodetection to use ens34.
• Restarted Calico pods and kubelet, and flushed the routing cache using ip route flush cache.
• Manually created a dummy Secret, but this only moved the error to the main controller pods, which continue to lose the route to the Kubernetes API ClusterIP.

Question:

What is the correct way to diagnose and fix pod routing in Calico in order to resolve the no route to host error when accessing the Kubernetes API ClusterIP 10.233.0.1:443?