<p>I have installed bookinfo on EKS according to the instructions <a href="https://istio.io/docs/setup/kubernetes/helm-install/#option-2-install-with-helm-and-tiller-via-helm-install" rel="nofollow noreferrer">here</a> and <a href="https://istio.io/docs/examples/bookinfo/" rel="nofollow noreferrer">here</a>.  </p>

<p>While verifying that the application was installed correctly, i received <code>000</code> when trying to bring up the product page.  After checking my network connections VPC/Subnets/Routing/SecurityGroups, I have narrorwed the issue down to being an istio networking issue.</p>

<p>Upon further investigation, I logged into the istio-sidecar container for productpage and have noticed the following error.</p>

<pre><code>[2019-01-21 09:06:01.039][10][warning][upstream] external/envoy/source/common/config/grpc_mux_impl.cc:41] Unable to establish new stream
[2019-01-21 09:06:28.150][10][warning][upstream] external/envoy/source/common/config/grpc_mux_impl.cc:240] gRPC config stream closed: 14, no healthy upstream
</code></pre>

<p>This led me to to notice that the istio-proxy is pointing to the <code>istio-pilot.istio-system:15007</code> address for discovery.  Only the strange thing was, the kubernetes <code>istio-pilot.istio-system</code> service does not seem to be exposing port <code>15007</code> as shown below.</p>

<pre><code>[procyclinsur@localhost Downloads]$ kubectl get svc istio-pilot --namespace=istio-system
NAME          TYPE        CLUSTER-IP      EXTERNAL-IP   PORT(S)                                 AGE
istio-pilot   ClusterIP   172.20.185.72   &lt;none&gt;        15010/TCP,15011/TCP,8080/TCP,9093/TCP   1d
</code></pre>

<p>Infact none of the services from the <code>istio-system</code> namespace seem to expose that port.
I am assuming that this <code>istio-pilot.istio-system</code> address is the one used for gRPC and would like to know how to fix this as it seems to be pointing to the wrong address; please correct me if I am wrong.</p>

<p><strong>Relevant Logs</strong></p>

<p>istio-proxy</p>

<pre><code>2019-01-21T09:04:58.949152Z info    Version root@6f6ea1061f2b-docker.io/istio-1.0.5-c1707e45e71c75d74bf3a5dec8c7086f32f32fad-Clean
2019-01-21T09:04:58.949283Z info    Proxy role: model.Proxy{ClusterID:"", Type:"sidecar", IPAddress:"10.20.228.89", ID:"productpage-v1-54b8b9f55-jpz8g.default", Domain:"default.svc.cluster.local", Metadata:map[string]string(nil)}
2019-01-21T09:04:58.949971Z info    Effective config: binaryPath: /usr/local/bin/envoy
configPath: /etc/istio/proxy
connectTimeout: 10s
discoveryAddress: istio-pilot.istio-system:15007
discoveryRefreshDelay: 1s
drainDuration: 45s
parentShutdownDuration: 60s
proxyAdminPort: 15000
serviceCluster: productpage
zipkinAddress: zipkin.istio-system:9411
</code></pre>

<p>Ignore the gRPC warnings they are not meaningful.  Make sure you did the <code>kubectl apply -f samples/bookinfo/networking/bookinfo-gateway.yaml</code></p>

<p>If you do <code>kubectl exec $(kubectl get pod --selector app=ratings --output jsonpath='{.items[0].metadata.name}') -c istio-proxy -- ps -ef</code> you will see an entry like
<code>--discoveryAddress istio-pilot.istio-system:15011</code>.  That is the address the sidecar uses
to contact Pilot and SHOULD match an entry you see
using <code>kubectl -n istio-system get service istio-pilot</code>.</p>

<p>If the discoveryAddress matches a Pilot port you can test networking.  You can't easily <em>curl</em> on the discovery address but if you do <code>kubectl exec $(kubectl get pod --selector app=ratings --output jsonpath='{.items[0].metadata.name}') -c istio-proxy -- curl https://istio-pilot.istio-system:15011</code> and you get a timeout then there is a communication problem.</p>

<p>The discovery address comes from Istio configuration.  If you do <code>kubectl -n istio-system get cm istio-sidecar-injector</code> and the age is older than your Istio install there may have been a problem with upgrading an older Istio version.</p>
