Connecting to Istio ingress gateway gives a 404 error

Question

I installed istio v1.1.1 using the available helm chart.

I have

$ kubectl get svc istio-ingressgateway -n istio-system
NAME                   TYPE           CLUSTER-IP     EXTERNAL-IP     PORT(S)                                                                                                                                      AGE
istio-ingressgateway   LoadBalancer   10.31.251.20   35.189.53.230   80:31380/TCP,443:31390/TCP,31400:31400/TCP,15029:31920/TCP,15030:32305/TCP,15031:31084/TCP,15032:31163/TCP,15443:32714/TCP,15020:30964/TCP   3h

Then, I created a gateway and virtual service as follows:

apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: myservice-gateway
  namespace: stg
spec:
  selector:
    istio: ingressgateway # use Istio default gateway implementation
  servers:
  - hosts:
    - "stg.myservice.com"
    port:
      number: 80
      protocol: http
      name: http-myservice-port


---      

apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: myservice
  namespace: stg
spec:
  hosts:
    - "stg.myservice.com"
  gateways:
  - myservice-gateway         
  http:
  - match:
    - uri:
        prefix: /
    route:
    - destination:
        port:
          number: 8888
        host: myservice-service.stg.svc.cluster.local

I have made sure that the service is running correctly and when I port forward the pod, I can access it using localhost.

I can confirm that stg.myservice.com resolves to 35.189.53.230. I get this error

$ curl -i stg.myservice.com
HTTP/1.1 404 Not Found
location: http://stg.myservice.com/
date: Sun, 07 Apr 2019 05:54:59 GMT
server: istio-envoy
content-length: 0

What am I missing?

I see no errors in the ingress-gateway pod

PS: I have gateways.istio-ingressgateway.sds.enabled=true

Cacka

So you have a service called myservice-service in the namespace stg, running on port 8888, and it returns 200 on /? – Unsuccessful

yes, I can access http://myservice-service:8888 from another pod in the same cluster – Cacka

That's weird. And you say you don't see these requests (that end up with 404) with kubectl logs istio-ingressgateway-xxxxxx-xxxx -n istio-system? So it never goes through the gateway? Have you tried without SDS? – Unsuccessful

Can you paste your kubectl describe virtualservice output in the question too? – Sparling

Answer 1

In your virtualservice config you'll want to add a namespace to the gateway

stg/myservice-gateway 

instead of

myservice-gateway   

so something like this

apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: myservice
  namespace: stg
spec:
  hosts:
    - "stg.myservice.com"
  gateways:
  - stg/myservice-gateway         
  http:
  - match:
    - uri:
        prefix: /
    route:
    - destination:
        port:
          number: 8888
        host: myservice-service.stg.svc.cluster.local

Egesta