Internal traffic with VirtualService and DestinationRule

Networking
1

I am new to istio and I think I misunderstood something.
And I am using version 1.2.5 and had created a Gateway, VirtualService, and a DestinationRule with two subsets sending traffic to two versions of my service.

From the outside (traffic coming from outside Kubernetes) it is working pretty well. I am seeing traffic on the two versions of my service.

By when traffic comes from a service inside Kubernetes (ex: another service on the k8s) none of
VirtualService or DestinationRule seems to work. I am only seeing traffic on just one version of my service.

The scenario:

Internet -> IstioGateway  -> VirtualService -> DestinationRule ---> Service_A_version_v1
                                                              |---> Service_A_version_v2

Service_B( with envoy) -> service_a.service_a-ns.svc.cluster.local --> Service_A_version_v1 (DestinationRule does not work)

If I understand correctly (and also configure correctly) DestinationRule from inside (mesh) should send traffic to the two versions, right?)

What I am doing wrong?

---
apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: istio-gateway
  namespace: istio-system
spec:
  selector:
    istio: ingressgateway
  servers:
  - port:
      number: 80
      name: http
      protocol: HTTP
    hosts:
    - "*.mydomain.io"
---
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: my-service-a
  namespace: my-service-a-ns
spec:
  hosts:
  - "*.mydomain.io"
  - my-service-a.my-service-a-ns.svc.cluster.local
  gateways:
  - istio-gateway.istio-system.svc.cluster.local
  http:
  - match:
    - uri:
        prefix: "/my-service-a"
    rewrite:
      uri: /
    route:
    - destination:
        host: my-service-a.my-service-a-ns.svc.cluster.local
        port:
          number: 8080
        subset: v1
      weight: 50
    - destination:
        host: my-service-a.my-service-a-ns.svc.cluster.local
        port:
          number: 8080
        subset: v2
      weight: 50
---
apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
  name: my-service-a
  namespace: my-service-a-ns
spec:
  host: my-service-a.my-service-a-ns.svc.cluster.local
  subsets:
  - name: v1
    labels:
      version: v1
  - name: v2
    labels:
      version: v2
2

@Fabio_Sales
I think your virtual service is only bound to the Istio Gateway and not other sidecars. Try adding an another entry named mesh under gateways in your Virtual Service.

...
gateways:
- mesh
- istio-gateway...
...

You can find more info for the special keyword mesh in virtual service spec.

2 Likes
3

Thanks, @anilcs0405. It works.
The mash entry was necessary.
But actually I was wrong on uri http match.

When using Istio IngressGateway it is necessary to put uri path (http://istio-gateway.my-domain.io/my-service-a) as I will use the same Ingress for many services… but I was thinking that was not necessary when it came from an inside service (http://my-service-a.my-service-a-ns.svc.cluster.local).

When I put http://my-service-a.my-service-a-ns.svc.cluster.local/my-service-a the http math was catch and I see traffic on both services.

Thanks for the tip. :wink: