<p>I have deployed a Linkerd Service mesh and my Kubernetes cluster is configured with the Nginx ingress controller as a DaemonSet and all the ingresses are working fine also the Linkerd. Recently, I have  added a traffic split functionality to run my blue/green setup I can reach through to these services with separate ingress resources. I have created an apex-web service as described <a href="https://github.com/BuoyantIO/emojivoto/blob/linux-training/training/traffic-split/web-apex.yml" rel="nofollow noreferrer">here</a>. If I reached you this service internally it perfectly working. I have created another ingress resources and I'm not able to test the blue/green functionality outside of my cluster. I'd like to mention that I have meshed (injected the Linkerd proxy) to all my Nginx pods but it is returning &quot;<code>503 Service Temporarily Unavailable</code>&quot; message from the Nginx.</p>
<p>I went through the documentation and I have created ingress following <a href="https://linkerd.io/2/tasks/using-ingress/#nginx" rel="nofollow noreferrer">this</a>, I can confirm that below annotations were added to the ingress resources.</p>
<pre><code>annotations:
kubernetes.io/ingress.class: &quot;nginx&quot;
nginx.ingress.kubernetes.io/configuration-snippet: |
  proxy_set_header l5d-dst-override $service_name.$namespace.svc.cluster.local:$service_port;
  grpc_set_header l5d-dst-override $service_name.$namespace.svc.cluster.local:$service_port;
</code></pre>
<p>but still no luck with the out side of the cluster.</p>
<p>I'm testing with the given emojivoto app and all the traffic split and the apex-web services are in <a href="https://github.com/BuoyantIO/emojivoto/tree/linux-training/training/traffic-split" rel="nofollow noreferrer">this</a> training repository.</p>
<p>I'm not quite sure what went wrong and how to fix this outside from the cluster. I'd really  appreciate if anyone assist me to fix this Linkerd, Blue/Green issue.</p>

<p>tl;dr: The nginx ingress <a href="https://github.com/kubernetes/ingress-nginx/blob/master/internal/ingress/controller/controller.go#L427" rel="nofollow noreferrer">requires</a> a <code>Service</code> resource to have an <code>Endpoint</code> resource in order to be considered a valid destination for traffic. The architecture in the repo creates three <code>Service</code> resources, one of which acts as an <code>apex</code> and has no <code>Endpoint</code> resources because it has no selectors, so the nginx ingress won't send traffic to it, and the <code>leaf</code> services will not get traffic as a result.</p>
<p>The example in the repo follows the SMI Spec by defining a single <strong>apex</strong> service and two <strong>leaf</strong> services. The <code>web-apex</code> service does not have any endpoints, so nginx will not send traffic to it.</p>
<p>According to the <a href="https://github.com/servicemeshinterface/smi-spec/blob/master/apis/traffic-split/v1alpha1/traffic-split.md#tradeoffs" rel="nofollow noreferrer">SMI Spec</a> services can be <em>self-referential</em>, which means that a service can be both an <strong>apex</strong> and a <strong>leaf</strong> service, so to use the nginx ingress with this example, you can modify the <code>TrafficSplit</code> <a href="https://github.com/BuoyantIO/emojivoto/blob/linux-training/training/traffic-split/web-svc-ts.yml" rel="nofollow noreferrer">definition</a> to change the <code>spec.service</code> value from <code>web-apex</code> to <code>web-svc</code>:</p>
<pre class="lang-yaml prettyprint-override"><code>apiVersion: split.smi-spec.io/v1alpha1
kind: TrafficSplit
metadata:
  name: web-svc-ts
  namespace: emojivoto
spec:
  # The root service that clients use to connect to the destination application.
  service: web-svc
  # Services inside the namespace with their own selectors, endpoints and configuration.
  backends:
  - service: web-svc
    # Identical to resources, 1 = 1000m
    weight: 500m
  - service: web-svc-2
    weight: 500m
</code></pre>
