Getting error on GRPC ingress gateway: 404 NR route_not_found: NR filter_chain_not_found

Config
1

I am getting the below errors when configuring the istio gateway 1.9.1 istio version:

[2021-03-23T20:06:09.585Z] “- - -” 0 NR filter_chain_not_found - “-” 0 0 32 - “-” “-” “-” “-” “-” - - 100.104.126.178:8443 100.117.94.128:31490 - -

[2021-03-23T20:09:12.633Z] “- - -” 0 NR filter_chain_not_found - “-” 0 0 0 - “-” “-” “-” “-” “-” - - 100.104.126.178:8443 100.120.202.128:47094 - -

[2021-03-23T20:09:23.190Z] “- - -” 0 NR filter_chain_not_found - “-” 0 0 0 - “-” “-” “-” “-” “-” - - 100.104.126.178:8443 100.109.162.128:1642 - -

[2021-03-23T20:09:23.564Z] “- - -” 0 NR filter_chain_not_found - “-” 0 0 0 - “-” “-” “-” “-” “-” - - 100.104.126.178:8443 100.120.202.128:31710 - -

[2021-03-23T20:09:23.937Z] “- - -” 0 NR filter_chain_not_found - “-” 0 0 0 - “-” “-” “-” “-” “-” - - 100.104.126.178:8443 100.97.92.0:54307 - -

[2021-03-23T20:10:20.642Z] “GET /solr/ HTTP/1.1” 404 NR route_not_found - “-” 0 0 0 - “100.127.250.64” “Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36” “4033a922-5eb5-9c8a-9687-e6b79f3fb8d5” “44.240.155.82” “-” - - 100.104.126.178:8080 100.127.250.64:15853 - -

Configuration below:

apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
name: key-service
annotations:
type: grpc
spec:
selector:
istio: grpc-ingressgateway
servers:

  • port:
    number: 80
    name: http
    protocol: gRPC
    hosts:
    • “*.cap-staging.abc.xyz.com”
    • “*.xyz.com”
      tls:
      httpsRedirect: true
  • port:
    number: 443
    name: https
    protocol: HTTPS
    tls:
    mode: SIMPLE
    serverCertificate: /etc/istio/ingressgateway-certs/tls.crt
    privateKey: /etc/istio/ingressgateway-certs/tls.key
    hosts:
    • “*.cap-staging.abc.xyz.com”
    • “*.xyz.com”

apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
name: key-service
spec:
hosts:
- “.cap-staging.abc.xyz.com"
- ".xyz.com”

- “*”

gateways:

  • key-service
    http:
  • route:
    • destination:
      host: key-service
      port:
      number: 80
      corsPolicy:
      allowOrigin:
      • “*”
        allowMethods:
      • POST
      • GET
      • OPTIONS
      • PUT
      • DELETE
        allowHeaders:
      • grpc-timeout
      • content-type
      • keep-alive
      • user-agent
      • cache-control
      • content-type
      • content-transfer-encoding
      • custom-header-1
      • x-accept-content-transfer-encoding
      • x-accept-response-streaming
      • x-user-agent
      • x-grpc-web
      • authorization
        maxAge: 1728s
        exposeHeaders:
      • custom-header-1
      • grpc-status
      • grpc-message
      • authorization
        allowCredentials: true

apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
name: key-service
spec:
workloadSelector:
labels:
app: key-service
configPatches:

  • applyTo: HTTP_FILTER
    match:
    context: ANY
    patch:
    operation: INSERT_FIRST
    value:
    name: envoy.filters.http.grpc_web

kind: Service
apiVersion: v1
metadata:
name: key-service
labels:
app: key-service
spec:
ports:

  • name: grpc
    port: 80
    targetPort: 9200
    selector:
    app: key-service
2

The filter_chain_not_found is from requests that do not have a matching SNI