Connection refused error in outbound request in k8s app container. Istio?

8/19/2020

Updated

I have some script that initializes our service.
The script fails when it runs in the container because of connection refused error in the first outbound request (to external service) in the script.
We tried to add a loop that makes curl and if it fails, re-try, if not - continuous the script.
Sometimes it succeeds for the first time, sometimes it fails 10-15 times in a row.
We recently started using istio
What may be a reason??

-- Tantre
istio
kubernetes
kubernetes-pod

2 Answers

8/21/2020

With istio 1.7 comes a new feature that configures the pod to start the sidecar first and hold every other container untill the sidecar is started.

Just set values.proxy.holdApplicationUntilProxyStarts to true.

Please note that the feature is still experimental.

-- Chris
Source: StackOverflow

8/23/2020

It is a famous istio bug https://github.com/istio/istio/issues/11130 ( App container unable to connect to network before Istio's sidecar is fully running) it seems the Istio proxy will not start in parallel , it is waiting for the app container to be ready. a sequential startup sequence as one blogger mentioned (https://medium.com/@marko.luksa/delaying-application-start-until-sidecar-is-ready-2ec2d21a7b74) quote: most Kubernetes users assume that after a pod’s init containers have finished, the pod’s regular containers are started in parallel. It turns out that’s not the case.

containers will start in order defined by the Deployment spec YAML. so the biggest question is will the Istio proxy envoy will start while the first container is stuck in a curl-loop . (egg and chicken problem) . App container script performs:

until curl --head localhost:15000 ; do echo "Waiting for Istio Proxy to start" ; sleep 3 ; done

as far as I saw: that script doesn't help a bit. proxy is up but connection to external hostname return "connection refused"

-- taitelman
Source: StackOverflow