{"action":"created","issue":{"url":"https://api.github.com/repos/istio/istio/issues/9273","repository_url":"https://api.github.com/repos/istio/istio","labels_url":"https://api.github.com/repos/istio/istio/issues/9273/labels{/name}","comments_url":"https://api.github.com/repos/istio/istio/issues/9273/comments","events_url":"https://api.github.com/repos/istio/istio/issues/9273/events","html_url":"https://github.com/istio/istio/issues/9273","id":369045618,"node_id":"MDU6SXNzdWUzNjkwNDU2MTg=","number":9273,"title":"Pilot discover conflict logs and port conflicts","user":{"login":"vijaykumark","id":13167000,"node_id":"MDQ6VXNlcjEzMTY3MDAw","avatar_url":"https://avatars3.githubusercontent.com/u/13167000?v=4","gravatar_id":"","url":"https://api.github.com/users/vijaykumark","html_url":"https://github.com/vijaykumark","followers_url":"https://api.github.com/users/vijaykumark/followers","following_url":"https://api.github.com/users/vijaykumark/following{/other_user}","gists_url":"https://api.github.com/users/vijaykumark/gists{/gist_id}","starred_url":"https://api.github.com/users/vijaykumark/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/vijaykumark/subscriptions","organizations_url":"https://api.github.com/users/vijaykumark/orgs","repos_url":"https://api.github.com/users/vijaykumark/repos","events_url":"https://api.github.com/users/vijaykumark/events{/privacy}","received_events_url":"https://api.github.com/users/vijaykumark/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":4,"created_at":"2018-10-11T10:03:17Z","updated_at":"2018-12-06T06:42:24Z","closed_at":null,"author_association":"NONE","body":"**Describe the bug**\r\nOur application is running on Istio 1.0.2. There are two sets of keycloak and freeipa running outside the istio cluster but in the same k8s cluster. Cassandra is also running outside istio.  There are applications listening on same ports but over ClusterIP type services. Does it cause conflict in istio?\r\n\r\nBelow attached logs for istio pilot where there are several logs mentioning `pilot_conflict_inbound_listener, pilot_conflict_outbound_listener_http_over_current_tcp, pilot_conflict_outbound_listener_tcp_over_current_tcp,\r\npilot_duplicate_envoy_clusters, pilot_eds_no_instances?`\r\n\r\nWhat does these status mean: `pilot_conflict_inbound_listener, pilot_conflict_outbound_listener_http_over_current_tcp, pilot_conflict_outbound_listener_tcp_over_current_tcp,\r\npilot_duplicate_envoy_clusters, pilot_eds_no_instances?`\r\n\r\nCouldn't find any information about what those errors mean and how to resolve those errors.\r\nI have followed https://istio.io/docs/setup/kubernetes/spec-requirements/ and tried to name port names uniquely.\r\n\r\nAny guidance is deeply appreciated.\r\n\r\nHere are the pilot discover logs\r\n\r\n```\r\n2018-09-02T08:42:56.588149Z     info    ads     Push finished: 188.068326ms {\r\n    \"ProxyStatus\": {\r\n        \"pilot_conflict_inbound_listener\": {\r\n            \"project-app1-6cdccdf54c-q7jqv.project\": {\r\n                \"proxy\": \"project-app1-6cdccdf54c-q7jqv.project\",\r\n                \"message\": \"Rejected project-app1.project.svc.cluster.local, used project-app2.project.svc.cluster.local for 10.2.0.38:8080\"\r\n            }\r\n        },\r\n        \"pilot_conflict_outbound_listener_http_over_current_tcp\": {\r\n            \"0.0.0.0:8080\": {\r\n                \"proxy\": \"project-app3-97748c65b-cjb4w.project\",\r\n                \"message\": \"Listener=0.0.0.0:8080 AcceptedHTTP=keycloak.project.svc.cluster.local,kube-state-metrics.kube-system.svc.cluster.local RejectedTCP=keycloak2.project.svc.cluster.local HTTPServices=2\"\r\n            }\r\n        },\r\n        \"pilot_conflict_outbound_listener_tcp_over_current_tcp\": {\r\n            \"0.0.0.0:9042\": {\r\n                \"proxy\": \"project-app3-97748c65b-cjb4w.project\",\r\n                \"message\": \"Listener=0.0.0.0:9042 AcceptedTCP=cassandra.project.svc.cluster.local RejectedTCP=cassandra.project.svc.cluster.local TCPServices=1\"\r\n            },\r\n            \"10.3.0.1:443\": {\r\n                \"proxy\": \"project-app3-97748c65b-cjb4w.project\",\r\n                \"message\": \"Listener=10.3.0.1:443 AcceptedTCP=kubernetes.default.svc.cluster.local RejectedTCP=10.3.0.1 TCPServices=1\"\r\n            }\r\n        },\r\n        \"pilot_duplicate_envoy_clusters\": {\r\n            \"outbound|443||kubernetes.default.svc.cluster.local\": {\r\n                \"proxy\": \"istio-ingress-6475b8d5c8-kns6f.istio-system\",\r\n                \"message\": \"Duplicate cluster outbound|443||kubernetes.default.svc.cluster.local found while pushing CDS\"\r\n            },\r\n            \"outbound|8080||keycloak.project.svc.cluster.local\": {\r\n                \"proxy\": \"istio-ingress-6475b8d5c8-kns6f.istio-system\",\r\n                \"message\": \"Duplicate cluster outbound|8080||keycloak.project.svc.cluster.local found while pushing CDS\"\r\n            },\r\n            \"outbound|9042||cassandra.project.svc.cluster.local\": {\r\n                \"proxy\": \"istio-ingress-6475b8d5c8-kns6f.istio-system\",\r\n                \"message\": \"Duplicate cluster outbound|9042||cassandra.project.svc.cluster.local found while pushing CDS\"\r\n            }\r\n        },\r\n        \"pilot_eds_no_instances\": {\r\n            \"outbound|389||freeipa.project.svc.cluster.local\": {},\r\n            \"outbound|443||freeipa.project.svc.cluster.local\": {},\r\n            \"outbound|464||freeipa.project.svc.cluster.local\": {},\r\n            \"outbound|5601||kibana-logging.kube-system.svc.cluster.local\": {},\r\n            \"outbound|6790||rook-ceph-mon0.rook.svc.cluster.local\": {},\r\n            \"outbound|88||freeipa.project.svc.cluster.local\": {},\r\n            \"outbound|9200||elasticsearch-logging.kube-system.svc.cluster.local\": {}\r\n        }\r\n    },\r\n    \"Start\": \"2018-09-02T08:42:56.400062777Z\",\r\n    \"End\": \"2018-09-02T08:42:56.587934187Z\"\r\n}\r\n```\r\n\r\n**Expected behavior**\r\nWhat are the rules for defining port numbers to the applications? Can port 8080 be served by different services if they have type ClusterIP? \r\nNeed more documentation explaining this in https://istio.io/docs/setup/kubernetes/spec-requirements/\r\nIn the documentation they mention only about if a pod belongs to multiple k8s services. No mention if different pods with services have same ports.\r\n\r\n**Steps to reproduce the bug**\r\nRun several applications where different services are listening on port 8080 and port 80, 443. Service type is ClusterIP.\r\n\r\n**Version**\r\n```\r\n# istioctl version\r\nVersion: 1.0.2\r\nGitRevision: d639408fded355fb906ef2a1f9e8ffddc24c3d64\r\nUser: root@66ce69d4a51e\r\nHub: gcr.io/istio-release\r\nGolangVersion: go1.10.1\r\nBuildStatus: Clean\r\n```\r\n```\r\n# kubectl version\r\nClient Version: version.Info{Major:\"1\", Minor:\"9\", GitVersion:\"v1.9.6\", GitCommit:\"9f8ebd171479bec0ada837d7ee641dec2f8c6dd1\", GitTreeState:\"clean\", BuildDate:\"2018-03-21T15:21:50Z\", GoVersion:\"go1.9.3\", Compiler:\"gc\", Platform:\"linux/amd64\"}\r\nServer Version: version.Info{Major:\"1\", Minor:\"10\", GitVersion:\"v1.10.2\", GitCommit:\"81753b10df112992bf51bbc2c2f85208aad78335\", GitTreeState:\"clean\", BuildDate:\"2018-04-27T09:10:24Z\", GoVersion:\"go1.9.3\", Compiler:\"gc\", Platform:\"linux/amd64\"}\r\n```\r\n\r\n**Installation**\r\nIstio is installed with mTLS disabled using helm.\r\n\r\n**Environment**\r\nBare metal CoreOS Kubernetes\r\n\r\n\r\n"},"comment":{"url":"https://api.github.com/repos/istio/istio/issues/comments/444765635","html_url":"https://github.com/istio/istio/issues/9273#issuecomment-444765635","issue_url":"https://api.github.com/repos/istio/istio/issues/9273","id":444765635,"node_id":"MDEyOklzc3VlQ29tbWVudDQ0NDc2NTYzNQ==","user":{"login":"c-knowles","id":3053013,"node_id":"MDQ6VXNlcjMwNTMwMTM=","avatar_url":"https://avatars3.githubusercontent.com/u/3053013?v=4","gravatar_id":"","url":"https://api.github.com/users/c-knowles","html_url":"https://github.com/c-knowles","followers_url":"https://api.github.com/users/c-knowles/followers","following_url":"https://api.github.com/users/c-knowles/following{/other_user}","gists_url":"https://api.github.com/users/c-knowles/gists{/gist_id}","starred_url":"https://api.github.com/users/c-knowles/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/c-knowles/subscriptions","organizations_url":"https://api.github.com/users/c-knowles/orgs","repos_url":"https://api.github.com/users/c-knowles/repos","events_url":"https://api.github.com/users/c-knowles/events{/privacy}","received_events_url":"https://api.github.com/users/c-knowles/received_events","type":"User","site_admin":false},"created_at":"2018-12-06T06:42:24Z","updated_at":"2018-12-06T06:42:24Z","author_association":"NONE","body":"Might be related - using Istio 1.0.4, we get `pilot_conflict_inbound_listener` using definitions like these:\r\n\r\n```yaml\r\nkind: Service\r\napiVersion: v1\r\nmetadata:\r\n  name: gapi\r\n  labels:\r\n    tier: backend\r\n    app: gapi\r\nspec:\r\n  ports:\r\n    - port: 80\r\n      targetPort: app\r\n  selector:\r\n    app: gapi\r\n---\r\nkind: Service\r\napiVersion: v1\r\nmetadata:\r\n  name: gapi-lb\r\n  labels:\r\n    tier: backend\r\n    app: gapi\r\n  annotations:\r\n    external-dns.alpha.kubernetes.io/hostname: gapi\r\n    service.beta.kubernetes.io/aws-load-balancer-ssl-cert: arn:OBFUSCATED\r\n    service.beta.kubernetes.io/aws-load-balancer-backend-protocol: http\r\n    service.beta.kubernetes.io/aws-load-balancer-cross-zone-load-balancing-enabled: 'true'\r\nspec:\r\n  type: LoadBalancer\r\n  ports:\r\n    - port: 443\r\n      targetPort: app\r\n  selector:\r\n    app: gapi\r\n```\r\n\r\n(we define like this to avoid connecting to the load balancer service internally using http on port 443, I fully expect we'll get rid of all this as we migrate more into Istio native routing and mTLS)"}}
{"actor":{"display_login":"c-knowles"}}