VirtualService Routing issue

Networking
1

My issue is that I have 1 pod per version of deployment (v1 and v2 ) and I have setup the following virtualservice and destination rules, I still see routing to both the versions. I am using nginx-ingress on the edge into my cluster. first traffic gets routed to the first api (my-intent-api) and this api calls second api (my-intent-service). I do have includeIPRanges: “0.0.0.0” . I am not using mtls.

Sidecar injector seems to be working fine and I see the istio-proxy logs when traffic makes it to the pod. No matter what I do with the virtualservice routes/destination rules , traffic still seems to be routing to both the versions of each apis. Am I missing some global flag ?

apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
  name: my-intent-service
  namespace: mynamespace
spec:
  host: my-intent-service
  subsets:
  - name: v1
    labels:
      version: v1
  - name: v2
    labels:
      version: v2

---
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: my-intent-service
  namespace: mynamespace
spec:
  hosts:
  - my-intent-service.mynamespace.svc.cluster.local
  http:
  - route:
    - destination:
        host: my-intent-service.mynamespace.svc.cluster.local
        port:
          number: 50058
          name: grpc
        subset: v1
      weight: 100
    - destination:
        host: my-intent-service.mynamespace.svc.cluster.local
        port:
          number: 50058
          name: grpc
        subset: v2
      weight: 0

apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
  name: my-intent
  namespace: mynamespace
spec:
  host: my-intent-api
  subsets:
  - name: v1
    labels:
      version: v1
  - name: v2
    labels:
      version: v2

---
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: my-intent
  namespace: mynamespace
spec:
  hosts:
  - my-intent-api.mynamespace.svc.cluster.local
  http:
  - route:
    - destination:
        host: my-intent-api.mynamespace.svc.cluster.local
        subset: v1
      weight: 100
    - destination:
        host: my-intent-api.mynamespace.svc.cluster.local
        subset: v2
      weight: 0
2

Istio routing rules (VirtualService rules) are executed in a client proxy, not in the target service, so if you call the service directly from an nginx ingress it won’t do any of the Istio routing. You need to call it from either another Istio service or through an Istio Gateway.

A simple way to test service routing is using the sleep sample as a client.

Alternatively you can setup an ingress Gateway for your service like the example described here.