istio rules doesn't works from external calls

3/31/2020

I want that all ingress traffic for specific service is served by version 8 of this service.

Service is reachable from outside with following host:

my.ciro.it

If I call my.ciro.it I can see that rules works fine.Always respondes with 8 version. If I call my.ciro.it from other service (my2.ciro.it) rules doesn't works and service respondes alternative with version 8 or 9.

This is my virtual service and destination rules:

apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
  name: ciro-service2-destination-rules
spec:
  host: ciro-service2.myns.svc.cluster.local
  subsets:
  - labels:
      version: v8
    name: v8
  - labels:
      version: v9
    name: v9
  trafficPolicy:
    tls:
      mode: DISABLE
---

apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: ciro-service2-virtual-service
spec:
  hosts:
  - my.ciro.it
  gateways:
  - ciro-service2-gateway
  http:
  - match:
    - uri:
        prefix: /
    route:
    - destination:
        host: ciro-service2.myns.svc.cluster.local
        subset: v8
        port:
          number: 8082
      weight: 100
    - destination:
        host: ciro-service2.myns.svc.cluster.local
        subset: v9
        port:
          number: 8082
      weight: 0  

add gateway

apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: ciro-service2-gateway
spec:
  selector:
    istio: ingressgateway # use istio default controller
  servers:
  - port:
      number: 80
      name: http
      protocol: HTTP
    hosts:
    - "my.ciro.it"
---  
-- ciro
istio
kubernetes

2 Answers

4/2/2020

The solution is very simple.

gateways:
- ciro-service2-gateway
- mesh

Add mesh gateway, the rules also applied on internal calls.

-- ciro
Source: StackOverflow

4/1/2020

The hosts in Your yaml files is my.ciro.it. Which does not match with my2.ciro.it. If Your plan is to use these rules on both sub-domains hosts You can use wildcard hosts:

...
spec:
  hosts:
  - *.ciro.it
...

Otherwise You should have:

...
spec:
  hosts:
  - my2.ciro.it
...
-- Piotr Malec
Source: StackOverflow