3

Related issue

Istio envoy is dropping requests with Host header

The above issue is the only one that's even remotely similar to my issue. However, the Host in my header is service-b.myns.svc.cluster.local and I don't see why that should be a problem.

The situation

I've got a namespace with many Deployments and Services. And for each Service I've also defined a VirtualService. Example:

apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  labels:
    app: service-b
  name: service-b
  namespace: myns
spec:
  gateways:
  - myns.myns.svc.cluster.local
  hosts:
  - '*'
  http:
  - match:
    - uri:
        prefix: /.well-known
    - uri:
        prefix: /robots.txt
    - uri:
        prefix: /apple-app-site-association
    - uri:
        prefix: /favicon.ico
    - uri:
        prefix: /content/
    route:
    - destination:
        host: service-b.myns.svc.cluster.local
        port:
          number: 80

The problem

I have another service, call it service-a that should be able to retrieve /.well-known, robots.txt, /content/header, /content/footer etc. I'm assuming that, because I've defined a route for these paths to lead directly to service-b, they should be retrievable by service-a. However, the logs say this:

[2019-02-22T01:07:54.557Z] "GET /content/headerHTTP/1.1" 404 NR 0 0 0 - "-" "curl/7.52.1" "789b3b81-9f61-43c3-b01a-b66d35c1d635" "service-b" "-" - - 10.x.x.x:80 10.y.y.y:47526

Question #1

Per the Envoy docs, NR means no route. Have I not defined a route in my VirtualService?

Question #2

I can get a 200 response for each of those paths if I just plug them in to the URL bar in my browser (ie. <istio-ingressgateway-ip-address>/robots.txt). Why?

Some proggress

I've narrowed down the issue to the istio proxy on the pod for service-a. I did this by removing the istio-proxy sidecars one at a time. There are two cases in which I get successfull 200s from service-a:

[SVCA][ISTIOPROXY] ---> X [ISTIOPROXY][SVCB]  # Does not work
[SVCA][ISTIOPROXY] ---> X             [SVCB]  # Does not work
[SVCA]             ---> ✓             [SVCB]  # Does work
[SVCA]             ---> ✓ [ISTIOPROXY][SVCB]  # Does work
meh
  • 2,591
  • 4
  • 20
  • 33
  • `istioctl proxy-config endpoint service-a` reveals that it has a `HEALTHY outbound|80||service-b.myns.svc.cluster.local` endpoint in the configuration. EDIT: Actually two of them because `service-b` has two pods. – meh Feb 22 '19 at 01:56
  • You have gateways: specified. Do you *really* have a gateway set up in this way? That might also explain why this is routing externally via Istio Gateway... What happens if you remove that gateways: declaration? – Paul Annetts Feb 22 '19 at 07:32
  • Thanks @PaulAnnetts, the trouble is that the default gateway is `mesh` and I get this error: `wildcard host * is not allowed for virtual services bound to the mesh gateway`. -- Normally it would not be a `*` for hosts, however this is a test cluster that I have not set up with any DNS, so I have to hit it with an IP Address... well it looks like I can just put the IP Address there and delete the `gateways` block. -- But it still doesn't work... actually it looks like my `RDS` is `STALE` on all my pods except the `istio-ingressgateway` (`istioctl proxy-status`) – meh Feb 22 '19 at 19:21
  • 1
    FWIW... I tweaked a `ServiceEntry` and it started working. Then I tried to reproduce the issue but I was unable to get the same behavior. – meh Mar 21 '19 at 19:05

1 Answers1

1

You don't configured default route.

Example with default route:

apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  labels:
    app: service-b
  name: service-b
  namespace: myns
spec:
  gateways:
  - myns.myns.svc.cluster.local
  hosts:
  - '*'
  http:
  - match:
    - uri:
        prefix: /.well-known
    - uri:
        prefix: /robots.txt
    - uri:
        prefix: /apple-app-site-association
    - uri:
        prefix: /favicon.ico
    - uri:
        prefix: /content/
    route:
    - destination:
        host: service-a.myns.svc.cluster.local
        port:
          number: 80
  - route:
    - destination:
        host: service-b.myns.svc.cluster.local
        port:
          number: 80
Turbosnail
  • 21
  • 5