<p>I'm having a problem migrating my pure Kubernetes app to an Istio managed. I'm using Google Cloud Platform (GCP), Istio 1.4, Google Kubernetes Engine (GKE), Spring Boot and JAVA 11.</p>
<p>I had the containers running in a pure GKE environment without a problem. Now I started the migration of my Kubernetes cluster to use Istio. Since then I'm getting the following message when I try to access the exposed service.</p>
<p><strong>upstream connect error or disconnect/reset before headers. reset reason: connection failure</strong></p>
<p>This error message looks like a really generic. I found a lot of different problems, with the same error message, but no one was related to my problem.</p>
<p>Bellow the version of the Istio:</p>
<pre><code>client version: 1.4.10
control plane version: 1.4.10-gke.5
data plane version: 1.4.10-gke.5 (2 proxies)
</code></pre>
<p>Bellow my yaml files:</p>
<pre><code>apiVersion: v1
kind: ServiceAccount
metadata:
  labels:
    account: tree-guest
  name: tree-guest-service-account
---
apiVersion: v1
kind: Service
metadata:
  labels:
    app: tree-guest
    service: tree-guest
  name: tree-guest
spec:
  ports:
  - name: http
    port: 8080
    targetPort: 8080
  selector:
    app: tree-guest
---
apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app: tree-guest
    version: v1
  name: tree-guest-v1
spec:
  replicas: 1
  selector:
    matchLabels:
      app: tree-guest
      version: v1
  template:
    metadata:
      labels:
        app: tree-guestaz
        version: v1
    spec:
      containers:
      - image: registry.hub.docker.com/victorsens/tree-quest:circle_ci_build_00923285-3c44-4955-8de1-ed578e23c5cf
        imagePullPolicy: IfNotPresent
        name: tree-guest
        ports:
        - containerPort: 8080
      serviceAccount: tree-guest-service-account
---
apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: tree-guest-gateway
spec:
  selector:
    istio: ingressgateway # use istio default controller
  servers:
    - port:
        number: 80
        name: http
        protocol: HTTP
      hosts:
        - &quot;*&quot;
---
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: tree-guest-virtual-service
spec:
  hosts:
    - &quot;*&quot;
  gateways:
    - tree-guest-gateway
  http:
    - match:
        - uri:
            prefix: /v1
      route:
        - destination:
            host: tree-guest
            port:
              number: 8080
</code></pre>
<p>To apply the yaml file I used the following argument:</p>
<pre><code>kubectl apply -f &lt;(istioctl kube-inject -f ./tree-guest.yaml)
</code></pre>
<p>Below the result of the Istio proxy argument, after deploying the application:</p>
<pre><code>istio-ingressgateway-6674cc989b-vwzqg.istio-system SYNCED SYNCED SYNCED SYNCED 
istio-pilot-ff4489db8-2hx5f 1.4.10-gke.5 tree-guest-v1-774bf84ddd-jkhsh.default SYNCED SYNCED SYNCED SYNCED istio-pilot-ff4489db8-2hx5f 1.4.10-gke.5
</code></pre>
<p>If someone have a tip about what is going wrong, please let me know. I'm stuck in this problem for a couple of days.</p>
<p>Thanks.</p>

<p>As @Victor mentioned the problem here was the wrong yaml file.</p>
<blockquote>
<p>I solve it. In my case the yaml file was wrong. I reviewed it and the problem now is solved. Thank you guys., – Victor</p>
</blockquote>
<p>If you're looking for yaml samples I would suggest to take a look at <a href="https://github.com/istio/istio/tree/master/samples" rel="noreferrer">istio github samples</a>.</p>
<hr />
<p>As <code>503 upstream connect error or disconnect/reset before headers. reset reason: connection failure</code> occurs very often I set up little troubleshooting answer, there are another questions with 503 error which I encountered for several months with answers, useful informations from istio documentation and things I would check.</p>
<p>Examples with 503 error:</p>
<ul>
<li><a href="https://stackoverflow.com/questions/58509666/istio-503s-between-public-gateway-and-service">Istio 503:s between (Public) Gateway and Service</a></li>
<li><a href="https://stackoverflow.com/questions/59174478/istio-egress-gateway-gives-http-503-error">IstIO egress gateway gives HTTP 503 error</a></li>
<li><a href="https://stackoverflow.com/questions/60074732/istio-ingress-gateway-with-tls-termination-returning-503-service-unavailable">Istio Ingress Gateway with TLS termination returning 503 service unavailable</a></li>
<li><a href="https://stackoverflow.com/questions/59560394/how-to-terminate-ssl-at-ingress-gateway-in-istio">how to terminate ssl at ingress-gateway in istio?</a></li>
<li><a href="https://stackoverflow.com/questions/54160215/accessing-service-using-istio-ingress-gives-503-error-when-mtls-is-enabled?rq=1">Accessing service using istio ingress gives 503 error when mTLS is enabled</a></li>
</ul>
<p>Common cause of 503 errors from istio documentation:</p>
<ul>
<li><a href="https://istio.io/docs/ops/best-practices/traffic-management/#avoid-503-errors-while-reconfiguring-service-routes" rel="noreferrer">https://istio.io/docs/ops/best-practices/traffic-management/#avoid-503-errors-while-reconfiguring-service-routes</a></li>
<li><a href="https://istio.io/docs/ops/common-problems/network-issues/#503-errors-after-setting-destination-rule" rel="noreferrer">https://istio.io/docs/ops/common-problems/network-issues/#503-errors-after-setting-destination-rule</a></li>
<li><a href="https://istio.io/latest/docs/concepts/traffic-management/#working-with-your-applications" rel="noreferrer">https://istio.io/latest/docs/concepts/traffic-management/#working-with-your-applications</a></li>
</ul>
<p>Few things I would check first:</p>
<ul>
<li>Check services ports name, Istio can route correctly the traffic if it knows the protocol. It should be <code>&lt;protocol&gt;[-&lt;suffix&gt;]</code> as mentioned in <a href="https://istio.io/latest/docs/ops/configuration/traffic-management/protocol-selection/#manual-protocol-selection" rel="noreferrer">istio
documentation</a>.</li>
<li>Check mTLS, if there are any problems caused by mTLS, usually those problems would result in error 503.</li>
<li>Check if istio works, I would recommend to apply <a href="https://istio.io/latest/docs/examples/bookinfo/" rel="noreferrer">bookinfo application</a> example and check if it works as expected.</li>
<li>Check if your namespace is <a href="https://istio.io/latest/docs/setup/additional-setup/sidecar-injection/" rel="noreferrer">injected</a> with <code>kubectl get namespace -L istio-injection</code></li>
<li>If the VirtualService using the subsets arrives before the DestinationRule where the subsets are defined, the Envoy configuration generated by Pilot would refer to non-existent upstream pools. This results in HTTP 503 errors until all configuration objects are available to Pilot.</li>
</ul>
