Istio traffic routing rules take no effect

Question

I am trying to configure a request routing using Istio and Ingress-nginx but I'm not able to route the requests properly. Basically I have two deployments each as a different subset and implemented a weighted VirtualService. In Kiali dashboard it shows the request being routed from the ingress-controller to PassthroughCluster even though I can see the correct route mapping using istioctl proxy-config routes command. Here is the complete configuration:

apiVersion: v1
kind: ServiceAccount
metadata:
  name: dummy-app
  namespace: my-namespace
---
apiVersion: v1
kind: Service
metadata:
  name: dummy-app
  namespace: my-namespace
  labels:
    app: dummy-app
    service: dummy-app
spec:
  ports:
  - port: 8080
    targetPort: 8080
    name: http-web
  selector:
    app: dummy-app
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: dummy-app-1
  namespace: my-namespace
spec:
  replicas: 1
  selector:
    matchLabels:
      app: dummy-app
      version: v1
  template:
    metadata:
      annotations:
        sidecar.istio.io/inject: "true"
      labels:
        app: dummy-app
        version: v1
    spec:
      serviceAccountName: dummy-app
      containers:
      - image: my-img
        imagePullPolicy: IfNotPresent
        name: dummy-app
        env:
          - name: X_HTTP_ENV
            value: dummy-app-1
        ports:
        - containerPort: 8080
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: dummy-app-2
  namespace: my-namespace
spec:
  replicas: 1
  selector:
    matchLabels:
      app: dummy-app
      version: v2
  template:
    metadata:
      annotations:
        sidecar.istio.io/inject: "true"
      labels:
        app: dummy-app
        version: v2
    spec:
      serviceAccountName: dummy-app
      containers:
      - image: my-img
        imagePullPolicy: IfNotPresent
        name: dummy-app
        env:
          - name: X_HTTP_ENV
            value: dummy-app-2
        ports:
        - containerPort: 8080
---
apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
  name: dummy-app
  namespace: my-namespace
spec:
  host: dummy-app
  subsets:
  - name: v1
    labels:
      version: v1
  - name: v2
    labels:
      version: v2
---
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: dummy-app
  namespace: my-namespace
spec:
  hosts:
    - dummy-app.my-namespace.svc.cluster.local
  http:
  - match:
    - uri:
        prefix: "/my-route"
    route:
      - destination:
          host: dummy-app.my-namespace.svc.cluster.local
          subset: v1
        weight: 0
      - destination:
          host: dummy-app.my-namespace.svc.cluster.local
          subset: v2
        weight: 100
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  annotations:
    kubernetes.io/ingress.class: "my-ingress-class"
    nginx.ingress.kubernetes.io/service-upstream: "true"
    nginx.ingress.kubernetes.io/upstream-vhost: dummy-app.my-namespace.svc.cluster.local
  name: dummy-ingress
  namespace: my-namespace
spec:
  rules:
  - host: myapp.com
    http:
      paths:
      - backend:
          service:
            name: dummy-app
            port:
              number: 8080
        path: /my-route(.*)
        pathType: ImplementationSpecific

Weird thing is I have other applications working in the same namespace and using the same ingress-controller, so I'm not considering there is a problem with ingress-nginx setup.

Istio version:

• client version: 1.11.4
• control plane version: 1.11.4
• data plane version: 1.11.4 (13 proxies), 1.12-dev (15 proxies)

Any ideas on what is the configuration problem or how can I better debug these kind of issues in Istio?

Answer 1

Main issue seems to be with ingress-nginx resource. Based on the above ingress definition, you are trying to bypass istio ingress gateway (where all the proxying rules has been implemented, like gateway,virtual-service and destination rules) and directly pushing the traffic to the application service from ingress. For istio proxy rules to work, you should let traffic pass through istio-ingressgateway (a service under istio-system namespace). So following changes should be made to your ingress resource:

  rules:
  - host: myapp.com
    http:
      paths:
      - backend:
          service:
            name: istio-ingressgateway.istio-system
            port:
              number: 80
        path: /my-route(.*)
        pathType: ImplementationSpecific