Connection stuck from sidecar enabled namespace to non-sidecar namespace which talks with MYSQL

Networking
1

We have too old istio version 1.4.3 so we are completely removing istio and installing the 1.12 version.

Re-installation Note:
We uninstalled helm installed istio 1.4.3 with same helm template method, deleted all resources from istio-system namespace and also
deleted the istio-system. The new installation is done with istioctl command.

Everything is working with latest version but only following scenario is not working which was working correctly on 1.4.3 version.

namespace1 has sidecar injected and running all nodejs workloads. Workloads login to MYSQL via a mysql-proxy installed on namespace2(this backend namespace has no sidecar injected). mysql-proxy deployment connects to MYSQL VM to perform the read and write operations.

Pod inside namespace1 connects to mysql-proxy deployment with “mysql -u user -h proxysql-mysql.namespace2.svc.cluster.local -P 6033 -p”
, the connection stuck and doesn’t complete. Telnet at port 6033 works.

Destinationrule is as follows:
apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
name: “mysql-proxy”
spec:
host: “proxysql-mysql.namespace2.svc.cluster.local”
trafficPolicy:
tls:
mode: DISABLE

The mesh_policy is "ALLOW_ANY.

The connection stuck and doesn’t return error.The istio-proxy and istiod logs not generating any error with debug mode.

It would be great help if we can get some guidance to diagnose the issue.

2

Hi, try put the follow metadata annotation in namespace1’s PODs:

metadata:
      annotations:
        traffic.sidecar.istio.io/excludeOutboundPorts: "6033"
3

Mysql is server first protocol, search istio server first.

4

Thank you for the reply!

The issue was within the kubernetes services. I required to add appProtocol: tcp inside proxy-reader and proxy-writer service to make it working.