<p>I am trying to follow the <a href="https://istio.io/docs/examples/bookinfo/" rel="nofollow noreferrer">Istio BookInfo example</a> for Kubernetes. But instead of installing the resources in the <code>default</code> namespace, I am using a namespace called <code>qa</code>. On step 5 is where I am running into an issue. When I try to curl the productpage I get the following response:</p>

<p><code>upstream connect error or disconnect/reset before headers. reset reason: connection termination</code></p>

<p>However, if I follow the same example but use the <code>default</code> namespace a get a successful response from the productpage.</p>

<p>Any ideas why this is breaking in my <code>qa</code> namespace?</p>

<p>Istio version:</p>

<pre><code>client version: 1.2.4
citadel version: 1.2.2
egressgateway version: 1.2.2
galley version: 1.2.2
ingressgateway version: 1.2.2
pilot version: 1.2.2
policy version: 1.2.2
sidecar-injector version: 1.2.2
telemetry version: 1.2.2
</code></pre>

<p>Kubernetes version (running in AKS):</p>

<pre><code>Client Version: version.Info{Major:"1", Minor:"14", GitVersion:"v1.14.3", GitCommit:"5e53fd6bc17c0dec8434817e69b04a25d8ae0ff0", GitTreeState:"clean", BuildDate:"2019-06-06T01:44:30Z", GoVersion:"go1.12.5", Compiler:"gc", Platform:"windows/amd64"}
Server Version: version.Info{Major:"1", Minor:"13", GitVersion:"v1.13.7", GitCommit:"4683545293d792934a7a7e12f2cc47d20b2dd01b", GitTreeState:"clean", BuildDate:"2019-06-06T01:39:30Z", GoVersion:"go1.11.5", Compiler:"gc", Platform:"linux/amd64"}
</code></pre>

<p>I would recommend the following steps in order to debug the reported issue:</p>

<ol>
<li>Check whether sidecar has injected into <code>qa</code> namespace:</li>
</ol>

<p><code>$ kubectl get namespace -L istio-injection| grep qa</code></p>

<pre><code>qa                Active   83m   enabled
</code></pre>

<ol start="2">
<li>Verify k8s <strong>Bookinfo</strong> app resources properly distributed and located in <code>qa</code> namespace:</li>
</ol>

<p><code>$ kubectl get all -n qa</code></p>

<pre><code>NAME                                  READY   STATUS    RESTARTS   AGE
pod/details-v1-74f858558f-vh97g       2/2     Running   0          29m
pod/productpage-v1-8554d58bff-5tpbl   2/2     Running   0          29m
pod/ratings-v1-7855f5bcb9-hhlds       2/2     Running   0          29m
pod/reviews-v1-59fd8b965b-w9lk5       2/2     Running   0          29m
pod/reviews-v2-d6cfdb7d6-hsjqq        2/2     Running   0          29m
pod/reviews-v3-75699b5cfb-vl7t9       2/2     Running   0          29m


NAME                  TYPE        CLUSTER-IP       EXTERNAL-IP   PORT(S)    AGE
service/details       ClusterIP   IP_ADDR          &lt;none&gt;        9080/TCP   29m
service/productpage   ClusterIP   IP_ADDR          &lt;none&gt;        9080/TCP   29m
service/ratings       ClusterIP   IP_ADDR          &lt;none&gt;        9080/TCP   29m
service/reviews       ClusterIP   IP_ADDR          &lt;none&gt;        9080/TCP   29m


NAME                             READY   UP-TO-DATE   AVAILABLE   AGE
deployment.apps/details-v1       1/1     1            1           29m
deployment.apps/productpage-v1   1/1     1            1           29m
deployment.apps/ratings-v1       1/1     1            1           29m
deployment.apps/reviews-v1       1/1     1            1           29m
deployment.apps/reviews-v2       1/1     1            1           29m
deployment.apps/reviews-v3       1/1     1            1           29m

NAME                                        DESIRED   CURRENT   READY   AGE
replicaset.apps/details-v1-74f858558f       1         1         1       29m
replicaset.apps/productpage-v1-8554d58bff   1         1         1       29m
replicaset.apps/ratings-v1-7855f5bcb9       1         1         1       29m
replicaset.apps/reviews-v1-59fd8b965b       1         1         1       29m
replicaset.apps/reviews-v2-d6cfdb7d6        1         1         1       29m
replicaset.apps/reviews-v3-75699b5cfb       1         1         1       29m
</code></pre>

<p><code>$ kubectl get sa -n qa</code></p>

<pre><code>NAME                   SECRETS   AGE
bookinfo-details       1         36m
bookinfo-productpage   1         36m
bookinfo-ratings       1         36m
bookinfo-reviews       1         36m
default                1         97m
</code></pre>

<ol start="3">
<li>Inspect Istio <a href="https://istio.io/docs/concepts/what-is-istio/#envoy" rel="nofollow noreferrer">Envoy</a> in particular Pod container, thus you can extract some essential data about proxy state and traffic routing information:</li>
</ol>

<p><code>kubectl logs $(kubectl get pod -l app=ratings -o jsonpath='{.items[0].metadata.name}' -n qa) -c istio-proxy -n qa</code></p>

<p>I encourage you to look at Istio network traffic-management <a href="https://istio.io/docs/tasks/traffic-management/ingress/secure-ingress-mount/#troubleshooting" rel="nofollow noreferrer">troubleshooting</a> documentation chapter to get some more insights.</p>
