{"action":"created","issue":{"url":"https://api.github.com/repos/istio/istio/issues/6469","repository_url":"https://api.github.com/repos/istio/istio","labels_url":"https://api.github.com/repos/istio/istio/issues/6469/labels{/name}","comments_url":"https://api.github.com/repos/istio/istio/issues/6469/comments","events_url":"https://api.github.com/repos/istio/istio/issues/6469/events","html_url":"https://github.com/istio/istio/issues/6469","id":334558816,"node_id":"MDU6SXNzdWUzMzQ1NTg4MTY=","number":6469,"title":"Istio 0.8.0 VirtualService missmatch hosts when port is added","user":{"login":"prune998","id":1110398,"node_id":"MDQ6VXNlcjExMTAzOTg=","avatar_url":"https://avatars2.githubusercontent.com/u/1110398?v=4","gravatar_id":"","url":"https://api.github.com/users/prune998","html_url":"https://github.com/prune998","followers_url":"https://api.github.com/users/prune998/followers","following_url":"https://api.github.com/users/prune998/following{/other_user}","gists_url":"https://api.github.com/users/prune998/gists{/gist_id}","starred_url":"https://api.github.com/users/prune998/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/prune998/subscriptions","organizations_url":"https://api.github.com/users/prune998/orgs","repos_url":"https://api.github.com/users/prune998/repos","events_url":"https://api.github.com/users/prune998/events{/privacy}","received_events_url":"https://api.github.com/users/prune998/received_events","type":"User","site_admin":false},"labels":[{"id":735781806,"node_id":"MDU6TGFiZWw3MzU3ODE4MDY=","url":"https://api.github.com/repos/istio/istio/labels/area/networking","name":"area/networking","color":"0e8a16","default":false},{"id":964067291,"node_id":"MDU6TGFiZWw5NjQwNjcyOTE=","url":"https://api.github.com/repos/istio/istio/labels/env/gke","name":"env/gke","color":"2f43c4","default":false},{"id":822212191,"node_id":"MDU6TGFiZWw4MjIyMTIxOTE=","url":"https://api.github.com/repos/istio/istio/labels/kind/customer%20issue","name":"kind/customer issue","color":"fbca04","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":{"url":"https://api.github.com/repos/istio/istio/milestones/9","html_url":"https://github.com/istio/istio/milestone/9","labels_url":"https://api.github.com/repos/istio/istio/milestones/9/labels","id":3058526,"node_id":"MDk6TWlsZXN0b25lMzA1ODUyNg==","number":9,"title":"1.1","description":"Milestone for everything that should be in the release immediately following 1.0","creator":{"login":"ldemailly","id":3664595,"node_id":"MDQ6VXNlcjM2NjQ1OTU=","avatar_url":"https://avatars2.githubusercontent.com/u/3664595?v=4","gravatar_id":"","url":"https://api.github.com/users/ldemailly","html_url":"https://github.com/ldemailly","followers_url":"https://api.github.com/users/ldemailly/followers","following_url":"https://api.github.com/users/ldemailly/following{/other_user}","gists_url":"https://api.github.com/users/ldemailly/gists{/gist_id}","starred_url":"https://api.github.com/users/ldemailly/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ldemailly/subscriptions","organizations_url":"https://api.github.com/users/ldemailly/orgs","repos_url":"https://api.github.com/users/ldemailly/repos","events_url":"https://api.github.com/users/ldemailly/events{/privacy}","received_events_url":"https://api.github.com/users/ldemailly/received_events","type":"User","site_admin":false},"open_issues":269,"closed_issues":102,"state":"open","created_at":"2018-01-23T19:25:27Z","updated_at":"2018-07-17T15:07:11Z","due_on":null,"closed_at":null},"comments":6,"created_at":"2018-06-21T16:02:40Z","updated_at":"2018-07-19T14:02:16Z","closed_at":null,"author_association":"CONTRIBUTOR","body":"**Describe the bug**\r\nWhen using the IngressGateway and defining a VirtualService, the `hosts` list makes difference between `<host>` and `<host>:<port>`\r\n\r\n**Expected behavior**\r\nBy RFC, the `Host:` header of HTTP can be the plain `<host>` or `<host>:<port>`. The VirtualService should consider the two as beeing the same.\r\n\r\n**Steps to reproduce the bug**\r\nI started with the howto at https://istio.io/docs/tasks/traffic-management/ingress/\r\n\r\nmy domain name is `authd.test.run1.k8s.xx.ca`\r\nI defined a Gateway : \r\n```\r\napiVersion: networking.istio.io/v1alpha3\r\nkind: Gateway\r\nmetadata:\r\n  name: authd-gateway\r\nspec:\r\n  selector:\r\n    istio: ingressgateway\r\n  servers:\r\n  - port:\r\n      number: 80\r\n      name: http\r\n      protocol: HTTP\r\n    hosts:\r\n    - \"authd.test.run1.k8s.xxx.ca\"\r\n  - port:\r\n      number: 443\r\n      name: https\r\n      protocol: HTTPS\r\n    tls:\r\n      mode: SIMPLE\r\n      serverCertificate: /etc/istio/ingressgateway-certs/tls.crt\r\n      privateKey: /etc/istio/ingressgateway-certs/tls.key\r\n    hosts:\r\n    - \"authd.test.run1.k8s.xxx.ca\"\r\n```\r\nAnd a VirtualService : \r\n```\r\napiVersion: networking.istio.io/v1alpha3\r\nkind: VirtualService\r\n  name: authd-http\r\n  namespace: test\r\nspec:\r\n  gateways:\r\n  - authd-gateway\r\n  hosts:\r\n  - authd.test.run1.k8s.xxx.ca\r\n  http:\r\n  - match:\r\n    - uri:\r\n        prefix: /\r\n    route:\r\n    - destination:\r\n        host: authd-http\r\n        port:\r\n          number: 1080\r\n```\r\nThan try with curl : \r\n```\r\ncurl -kvs -HHost:authd.test.run1.k8s.xxx.ca https://authd.test.run1.k8s.xxx.ca -I\r\nHTTP/1.1 200 OK\r\n```\r\nwhile : \r\n```\r\ncurl -kvs -HHost:authd.test.run1.k8s.xxx.ca:80 https://authd.test.run1.k8s.xxx.ca -I\r\nHTTP/1.1 404 Not Found\r\n```\r\n\r\nIn the 2nd case, I see in the logs : \r\n```\r\ningressgateway [2018-06-21T15:57:28.956Z] \"HEAD / HTTP/1.1\" 404 NR 0 0 2 - \"10.132.0.5\" \"curl/7.47.0\" \"98c6f630-3d4e-93a1-870b-6b620b50504a\" \"authd.test.run1.k8s.xxx.ca:80\" \"-\"\r\n```\r\n\r\nTo make it work I had to change the `VirtualService` to : \r\n```\r\napiVersion: networking.istio.io/v1alpha3\r\nkind: VirtualService\r\n  name: authd-http\r\n  namespace: test\r\nspec:\r\n  gateways:\r\n  - authd-gateway\r\n  hosts:\r\n  - authd.test.run1.k8s.xxx.ca\r\n  - authd.test.run1.k8s.xxx.ca:80\r\n  - authd.test.run1.k8s.xxx.ca:443\r\n  http:\r\n  - match:\r\n    - uri:\r\n        prefix: /\r\n    route:\r\n    - destination:\r\n        host: authd-http\r\n        port:\r\n          number: 1080\r\n```\r\n\r\nEither there is another way to match the hosts (like using `*` ) or the documentation should warn about that.\r\nNote that Go http/gRPC seem to always send the port along the hostname.\r\n\r\n**Version**\r\nk8s 1.10.2\r\nIstio 0.8.0\r\n\r\n**Is Istio Auth enabled or not?**\r\nNo mTLS active\r\n\r\n**Environment**\r\nGKE\r\n"},"comment":{"url":"https://api.github.com/repos/istio/istio/issues/comments/406286865","html_url":"https://github.com/istio/istio/issues/6469#issuecomment-406286865","issue_url":"https://api.github.com/repos/istio/istio/issues/6469","id":406286865,"node_id":"MDEyOklzc3VlQ29tbWVudDQwNjI4Njg2NQ==","user":{"login":"prune998","id":1110398,"node_id":"MDQ6VXNlcjExMTAzOTg=","avatar_url":"https://avatars2.githubusercontent.com/u/1110398?v=4","gravatar_id":"","url":"https://api.github.com/users/prune998","html_url":"https://github.com/prune998","followers_url":"https://api.github.com/users/prune998/followers","following_url":"https://api.github.com/users/prune998/following{/other_user}","gists_url":"https://api.github.com/users/prune998/gists{/gist_id}","starred_url":"https://api.github.com/users/prune998/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/prune998/subscriptions","organizations_url":"https://api.github.com/users/prune998/orgs","repos_url":"https://api.github.com/users/prune998/repos","events_url":"https://api.github.com/users/prune998/events{/privacy}","received_events_url":"https://api.github.com/users/prune998/received_events","type":"User","site_admin":false},"created_at":"2018-07-19T14:02:16Z","updated_at":"2018-07-19T14:02:16Z","author_association":"CONTRIBUTOR","body":"@andraxylia (as you were named for this bug), I'm just testing the latest release, using images `release-1.0-latest-daily`.\r\n\r\nWhat I see now is the exact same behaviour as the one described first in this issue. \r\nHere are the `istio-ingressgateway` logs for 2 tests, first without the port, second with the port : \r\n```\r\n[2018-07-19T13:57:39.038Z] \"GET / HTTP/1.1\" 307 - 0 42 3 1 \"10.246.0.17\" \"curl/7.47.0\" \"d570e950-4d58-9b2e-8de9-44bb57f0a91d\" \"authd.dev.cluster2.k8s.xx.ca\" \"10.20.25.27:1080\"\r\n\r\n[2018-07-19T13:57:44.131Z] \"GET / HTTP/1.1\" 404 NR 0 0 2 - \"10.246.0.4\" \"curl/7.47.0\" \"1d6866c5-48a4-95ef-9ebb-165e036aad51\" \"authd.dev.cluster2.k8s.xx.ca:443\" \"-\"\r\n```\r\n\r\n**BUT**\r\n\r\nI can't add  a host that contains a port number anymore (`<host>:<port>`)\r\n\r\nSo this does not work anymore : \r\n```\r\napiVersion: networking.istio.io/v1alpha3\r\nkind: VirtualService\r\nmetadata:\r\n  name: authd-vs-ingress\r\nspec:\r\n  hosts:\r\n  - \"authd.dev.cluster2.k8s.xxx.ca\"\r\n  - \"authd.dev.cluster2.k8s.xxx.ca:443\"\r\n  gateways:\r\n  - ingress-gateway\r\n  http:\r\n  - match:\r\n    - uri:\r\n        prefix: /\r\n    route:\r\n    - destination:\r\n        port:\r\n          number: 1080\r\n        host: authd-http\r\n```\r\n\r\nThe error is now : \r\n```\r\nError from server: error when applying patch:\r\n{\"metadata\":{\"annotations\":{\"kubectl.kubernetes.io/last-applied-configuration\":\"{\\\"apiVersion\\\":\\\"networking.istio.io/v1alpha3\\\",\\\"kind\\\":\\\"VirtualService\\\",\\\"metadata\\\":{\\\"annotations\\\":{},\\\"name\\\":\\\"authd-vs-ingress\\\",\\\"namespace\\\":\\\"dev\\\"},\\\"spec\\\":{\\\"gateways\\\":[\\\"ingress-gateway\\\"],\\\"hosts\\\":[\\\"authd.dev.cluster2.k8s.xxx.ca\\\",\\\"authd.dev.cluster2.k8s.xxx.ca:443\\\"],\\\"http\\\":[{\\\"match\\\":[{\\\"uri\\\":{\\\"prefix\\\":\\\"/\\\"}}],\\\"route\\\":[{\\\"destination\\\":{\\\"host\\\":\\\"authd-http\\\",\\\"port\\\":{\\\"number\\\":1080}}}]}]}}\\n\"}},\"spec\":{\"hosts\":[\"authd.dev.cluster2.k8s.xxx.ca\",\"authd.dev.cluster2.k8s.xxx.ca:443\"]}}\r\nto:\r\nResource: \"networking.istio.io/v1alpha3, Resource=virtualservices\", GroupVersionKind: \"networking.istio.io/v1alpha3, Kind=VirtualService\"\r\nName: \"authd-vs-ingress\", Namespace: \"dev\"\r\nObject: &{map[\"apiVersion\":\"networking.istio.io/v1alpha3\" \"kind\":\"VirtualService\" \"metadata\":map[\"annotations\":map[\"kubectl.kubernetes.io/last-applied-configuration\":\"{\\\"apiVersion\\\":\\\"networking.istio.io/v1alpha3\\\",\\\"kind\\\":\\\"VirtualService\\\",\\\"metadata\\\":{\\\"annotations\\\":{},\\\"name\\\":\\\"authd-vs-ingress\\\",\\\"namespace\\\":\\\"dev\\\"},\\\"spec\\\":{\\\"gateways\\\":[\\\"ingress-gateway\\\"],\\\"hosts\\\":[\\\"authd.dev.cluster2.k8s.xxx.ca\\\"],\\\"http\\\":[{\\\"match\\\":[{\\\"uri\\\":{\\\"prefix\\\":\\\"/\\\"}}],\\\"route\\\":[{\\\"destination\\\":{\\\"host\\\":\\\"authd-http\\\",\\\"port\\\":{\\\"number\\\":1080}}}]}]}}\\n\"] \"resourceVersion\":\"89496739\" \"uid\":\"7995d76a-8b57-11e8-971f-42010a8e0011\" \"clusterName\":\"\" \"creationTimestamp\":\"2018-07-19T13:27:25Z\" \"generation\":'\\x01' \"name\":\"authd-vs-ingress\" \"namespace\":\"dev\" \"selfLink\":\"/apis/networking.istio.io/v1alpha3/namespaces/dev/virtualservices/authd-vs-ingress\"] \"spec\":map[\"http\":[map[\"match\":[map[\"uri\":map[\"prefix\":\"/\"]]] \"route\":[map[\"destination\":map[\"host\":\"authd-http\" \"port\":map[\"number\":'\\u0438']]]]]] \"gateways\":[\"ingress-gateway\"] \"hosts\":[\"authd.dev.cluster2.k8s.xxx.ca\"]]]}\r\nfor: \"/tmp/kube_deploy/dev-authd-virtualservice.yml\": admission webhook \"pilot.validation.istio.io\" denied the request: configuration is invalid: domain name \"dev.cluster2.k8s.xx.ca:443\" invalid (label \"ca:443\" invalid)\r\n```\r\n\r\nSo : \r\n- the bug is not resolved\r\n- the way to circumvent the bug does not work anymore\r\n\r\nThe conclusion is you can't use the `istio-ingressgateway` with gRPC microservices (using the GO library at least)"}}
{"actor":{"display_login":"prune998"}}