When we switched to the use of nftables it appears that something changed in the way IP traffic is blocked inside the pod's network.

Previously one could do:

{{oc exec PODNAME -c CONTAINERNAME – curl localost:8080 }}

This now never returns. One must do:

oc exec PODNAME -c istio-proxy – curl localhost:8080

However, many applications likely use localhost for various things, and multi-container-pods almost assuredly do this.