<h2>Related issue</h2>

<p><a href="https://stackoverflow.com/questions/53188518/istio-envoy-is-dropping-requests-with-host-header">Istio envoy is dropping requests with Host header</a></p>

<p>The above issue is the only one that's even remotely similar to my issue. However, the Host in my header is <code>service-b.myns.svc.cluster.local</code> and I don't see why that should be a problem.</p>

<h2>The situation</h2>

<p>I've got a namespace with many <code>Deployment</code>s and <code>Service</code>s. And for each <code>Service</code> I've also defined a <code>VirtualService</code>. Example:</p>

<pre><code>apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  labels:
    app: service-b
  name: service-b
  namespace: myns
spec:
  gateways:
  - myns.myns.svc.cluster.local
  hosts:
  - '*'
  http:
  - match:
    - uri:
        prefix: /.well-known
    - uri:
        prefix: /robots.txt
    - uri:
        prefix: /apple-app-site-association
    - uri:
        prefix: /favicon.ico
    - uri:
        prefix: /content/
    route:
    - destination:
        host: service-b.myns.svc.cluster.local
        port:
          number: 80
</code></pre>

<h2>The problem</h2>

<p>I have another service, call it <code>service-a</code> that should be able to retrieve <code>/.well-known</code>, <code>robots.txt</code>, <code>/content/header</code>, <code>/content/footer</code> etc. I'm assuming that, because I've defined a route for these paths to lead directly to <code>service-b</code>, they should be retrievable by <code>service-a</code>. However, the logs say this:</p>

<pre><code>[2019-02-22T01:07:54.557Z] "GET /content/headerHTTP/1.1" 404 NR 0 0 0 - "-" "curl/7.52.1" "789b3b81-9f61-43c3-b01a-b66d35c1d635" "service-b" "-" - - 10.x.x.x:80 10.y.y.y:47526
</code></pre>

<h2>Question #1</h2>

<p>Per the <a href="https://www.envoyproxy.io/docs/envoy/latest/configuration/access_log" rel="nofollow noreferrer">Envoy docs</a>, <code>NR</code> means no route. Have I not defined a route in my <code>VirtualService</code>?</p>

<h2>Question #2</h2>

<p>I can get a <code>200</code> response for each of those paths if I just plug them in to the URL bar in my browser (ie. <code>&lt;istio-ingressgateway-ip-address&gt;/robots.txt</code>). Why?</p>

<h2>Some proggress</h2>

<p>I've narrowed down the issue to the istio proxy on the pod for <code>service-a</code>. I did this by removing the istio-proxy sidecars one at a time. There are two cases in which I get successfull <code>200</code>s from <code>service-a</code>:</p>

<pre><code>[SVCA][ISTIOPROXY] ---&gt; X [ISTIOPROXY][SVCB]  # Does not work
[SVCA][ISTIOPROXY] ---&gt; X             [SVCB]  # Does not work
[SVCA]             ---&gt; ✓             [SVCB]  # Does work
[SVCA]             ---&gt; ✓ [ISTIOPROXY][SVCB]  # Does work
</code></pre>

<p>You don't configured default route.</p>
<p>Example with default route:</p>
<pre><code>apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  labels:
    app: service-b
  name: service-b
  namespace: myns
spec:
  gateways:
  - myns.myns.svc.cluster.local
  hosts:
  - '*'
  http:
  - match:
    - uri:
        prefix: /.well-known
    - uri:
        prefix: /robots.txt
    - uri:
        prefix: /apple-app-site-association
    - uri:
        prefix: /favicon.ico
    - uri:
        prefix: /content/
    route:
    - destination:
        host: service-a.myns.svc.cluster.local
        port:
          number: 80
  - route:
    - destination:
        host: service-b.myns.svc.cluster.local
        port:
          number: 80
</code></pre>
