<p>I have a simple stateful with SFTP features and a second service try to connect to it.</p>
<p>When ISTIO is enabled, the connection is closed by the sftp service.
We can find this log:</p>
<pre><code>Bad protocol version identification '\026\003\001'
</code></pre>
<p>The routing is OK.</p>
<p>The service:</p>
<pre><code>apiVersion: v1
kind: Service
metadata:
  name: foo
  namespace: bar
spec:
  ports:
    - port: 22
      targetPort: 22
      protocol: TCP
      name: tcp-sftp
  selector:
    app.kubernetes.io/instance: foo-bar
</code></pre>
<p>I try to add a VirtualService with no luck:</p>
<pre><code>apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: foo-bar-destination-virtualservice
  namespace: bar
spec:
  hosts:
    - foo.bar.svc.cluster.local
  tcp:
    - match:
        - port: 22
      route:
        - destination:
            host: foo.bar.svc.cluster.local
            port:
              number: 22
</code></pre>
<p>The workaround is to disabled the sidecar on the sftp pod for now:</p>
<pre><code>sidecar.istio.io/inject: &quot;false&quot;
</code></pre>

<p>It seems Envoy proxy (and Istio by proxy) does not support SFTP protocol (<a href="https://github.com/istio/istio/issues/7664#issuecomment-411948731" rel="nofollow noreferrer">referecce</a>).<br />
Your workaround is currently the only way to make it work.</p>
<p>If you want your auto-discovered services in the mesh to route/access your SFTP service, you can additionally create <a href="https://istio.io/latest/docs/reference/config/networking/service-entry/" rel="nofollow noreferrer"><code>ServiceEntry</code></a> pointing to it.</p>
