<p>I have a problem with connecting two services on Kubernetes with Istio.
My service makes POST requests to the elasticsearch.</p>
<pre><code>2020-11-18T21:51:53.758079131Z org.elasticsearch.client.ResponseException: method [POST], host [http://elasticsearch:9200], URI [/_bulk?timeout=1m], status line [HTTP/1.1 503 Service Unavailable]
2020-11-18T21:51:53.758087238Z upstream connect error or disconnect/reset before headers. reset reason: connection failure
</code></pre>
<p>I read some questions/GitHub issues about that and one of the possible reasons could be <code>mtls</code>, so how can I disable it?</p>
<p>I was trying with this:</p>
<pre class="lang-yaml prettyprint-override"><code>apiVersion: &quot;security.istio.io/v1beta1&quot;
kind: &quot;PeerAuthentication&quot;
metadata:
  name: &quot;default&quot;
  namespace: &quot;istio-system&quot;
spec:
  mtls:
    mode: DISABLE
</code></pre>
<p>But with this <code>PeerAuthentication</code>, I'm not able to reach even my service.
Do you have any advice?</p>

<h2>Disable mtls</h2>
<p>This PeerAuthentication is the correct way to disable mtls.</p>
<pre><code>apiVersion: &quot;security.istio.io/v1beta1&quot;
kind: &quot;PeerAuthentication&quot;
metadata:
  name: &quot;default&quot;
  namespace: &quot;istio-system&quot;
spec:
  mtls:
    mode: DISABLE
</code></pre>
<p>There is istio <a href="https://istio.io/latest/docs/tasks/security/authentication/authn-policy/#" rel="nofollow noreferrer">documentation</a> about that.</p>
<hr />
<h2>Elasticsearch issue</h2>
<p>According to istio documentation:</p>
<blockquote>
<p>There are two Elasticsearch configuration parameters that need to be set appropriately to run Elasticsearch with Istio: <strong>network.bind_host</strong> and <strong>network.publish_host</strong>. By default, these parameters are set to the network.host parameter. If network.host is set to 0.0.0.0, Elasticsearch will most likely pick up the pod IP as the publishing address and no further configuration will be needed.</p>
<p>If the default configuration does not work, you can set the network.bind_host to 0.0.0.0 or localhost (127.0.0.1) and network.publish_host to the pod IP. For example:</p>
</blockquote>
<pre><code>...
containers:
- name: elasticsearch
  image: docker.elastic.co/elasticsearch/elasticsearch:7.2.0
  env:
    - name: network.bind_host
      value: 127.0.0.1
    - name: network.publish_host
      valueFrom:
        fieldRef:
          fieldPath: status.podIP
   ...
</code></pre>
<blockquote>
<p>Refer to <a href="https://www.elastic.co/guide/en/elasticsearch/reference/current/modules-network.html#modules-network" rel="nofollow noreferrer">Network Settings for Elasticsearch</a> for more information.</p>
</blockquote>
<p>If that won't work there are two github issues:</p>
<ul>
<li><a href="https://github.com/istio/istio/issues/14662#issuecomment-723669123" rel="nofollow noreferrer">https://github.com/istio/istio/issues/14662#issuecomment-723669123</a></li>
<li><a href="https://github.com/elastic/cloud-on-k8s/issues/2770" rel="nofollow noreferrer">https://github.com/elastic/cloud-on-k8s/issues/2770</a></li>
</ul>
<p>which suggest to use</p>
<pre><code>annotations:
  traffic.sidecar.istio.io/excludeOutboundPorts: &quot;&quot; 
  traffic.sidecar.istio.io/excludeInboundPorts: &quot;&quot;
</code></pre>
<p>There is elasticsearch <a href="https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-service-mesh-istio.html" rel="nofollow noreferrer">documentation</a> about that.</p>
