I’m trying to setup mesh expansion with a kube cluster running Istio 1.1 in AWS. I’ve gotten that to work successfully with the sample bookinfo app (as per 1.1 docs) with the details service stripped out from k8s and deployed to the mesh expanded VM.
On enabling mTLS for the namespace that the bookinfo app is running, the productpage is able to hit the reviews service successfully (running on K8s) but not details service (running on the mesh expanded VM). I looked at all logs and figured that the service is throwing a 503. On deeper investigation I found out the following details
- There are no listeners on the sidecar running on the VM
- The details service is logging encrypted access logs instead of the standard access logs
istioctl proxy-statusdoes not list the mesh expanded proxy info (which means that pilot did not relay any info to the side car) which is likely the root cause of the 503 issue (if pilot doesn’t relay any info)
- There’s no errors in the VM logs other than a WARN " gRPC config stream closed: 14, upstream connect error or disconnect/reset before headers"
Can anyone help me in figuring out this issue?