<p>I used to use Type: LoadBalancer to expose my service through reverse proxy. Everything worked fine without Istio.
However, error happened when I applied Istio to my cluster.</p>

<p>I tried to expose my services in Kubernetes with Istio Ingress, but I think I misunderstand something when routing services with Istio.</p>

<p>I have 2 deployments in same namespace (See picture below):</p>

<p>1: Application (Bus-id)</p>

<p>2: Reverse Proxy of application (Bus-Proxy): Translate HTTP to gRPC </p>

<p><a href="https://drive.google.com/file/d/1tby9_taJb9WMHi0ssO9Os7MQAWRMga6k/view?usp=sharing" rel="nofollow noreferrer">https://drive.google.com/file/d/1tby9_taJb9WMHi0ssO9Os7MQAWRMga6k/view?usp=sharing</a></p>

<p>Version:</p>

<ul>
<li><p>Kubernetes version (AKS with RBAC enabled):</p>

<p>Client Version: v1.15.0</p>

<p>Server Version: v1.12.8</p></li>
<li><p>Istio version: 1.1.3 (AKS said that they tested on 1.1.3)</p></li>
<li><p>Helm: </p>

<p>Client: &amp;version.Version{SemVer:"v2.13.0", GitCommit:"79d07943b03aea2b76c12644b4b54733bc5958d6", GitTreeState:"clean"}</p>

<p>Server: &amp;version.Version{SemVer:"v2.14.1",   GitCommit:"5270352a09c7e8b6e8c9593002a73535276507c0", GitTreeState:"clean"}</p></li>
</ul>

<p>I tried <strong>BookInfo</strong> example in <strong>Istio</strong> (<a href="https://istio.io/docs/examples/bookinfo/" rel="nofollow noreferrer">https://istio.io/docs/examples/bookinfo/</a>), it worked.</p>

<p>But, I tried <strong>Voting</strong> example in <strong>AKS</strong> (<a href="https://learn.microsoft.com/en-us/azure/aks/istio-scenario-routing" rel="nofollow noreferrer">https://learn.microsoft.com/en-us/azure/aks/istio-scenario-routing</a>), I can't access example with external load balancer's IP, it retun "timeout"</p>

<p>Deployment file:</p>

<p><strong>1. bus-id.yaml</strong></p>

<pre><code>apiVersion: extensions/v1beta1
kind: Deployment
metadata:
  name: bus-id
  namespace: smart-id
  labels:
    k8s-app: bus-id
spec:
  selector:
    matchLabels:
      k8s-app: bus-id
  template:
    metadata:
      name: bus-id
      labels:
        k8s-app: bus-id
    spec:
      containers:
        - name: bus-id
          image: mydockerhub/mydockerhub:bus-id
          ports:
            - containerPort: 50001
          env:

            - name: APP_NAME
              value: bus-id
---
apiVersion: v1
kind: Service
metadata:
  name: bus-id
  namespace: smart-id
  labels:
    service: bus-id
spec:
  ports:
    - name: http
      port: 50001
      targetPort: 50001
      protocol: TCP
  selector:
    k8s-app: bus-id

</code></pre>

<p><strong>2. bus-proxy.yaml</strong></p>

<pre><code>apiVersion: extensions/v1beta1
kind: Deployment
metadata:
  labels:
    k8s-app: bus-proxy
  name: bus-proxy
  namespace: smart-id
spec:
  selector:
    matchLabels:
      k8s-app: bus-proxy
  replicas: 1
  template:
    metadata:
      labels:
        k8s-app: bus-proxy
    spec:
      imagePullSecrets:
        - name: duynd
      containers:
        - image: mydockerhub/mydockerhub:bus-proxy
          name: bus-proxy
          ports:
            - containerPort: 40001
              name: http
          env:
            - name: APP_NAME
              value: bus-proxy
---
apiVersion: v1
kind: Service
metadata:
  name: bus-proxy
  namespace: smart-id
  labels:
    service: bus-proxy
spec:
  ports:
    - port: 8080
      targetPort: 40001
      protocol: TCP
  selector:
    k8s-app: bus-proxy

</code></pre>

<p><strong>3. ingress.yaml</strong></p>

<pre><code>apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: smartid-gateway
  namespace: smart-id
spec:
  selector:
    istio: ingressgateway # use istio default controller
  servers:
    - port:
        number: 80
        name: http
        protocol: HTTP
      hosts:
        - "*"
---
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: smartid
  namespace: smart-id
spec:
  hosts:
    - "*"
  gateways:
    - smart-id/smartid-gateway
  http:
    - match:
        - uri:
            prefix: /api
      route:
        - destination:
            host: bus-proxy.smart-id.svc.cluster.local
            port:
              number: 8080

</code></pre>

<p>I expect It works with ingress-ip:ingress-port/api/my-function (method POST). However, it returns error 500, <strong>bus-proxy</strong>'s POD also prints log (I think that the request came to <strong>bus-proxy</strong> successfully, but can go through to <strong>bus-id</strong>).</p>

<ul>
<li>I also post on issue on github (<a href="https://github.com/istio/istio/issues/16069" rel="nofollow noreferrer">https://github.com/istio/istio/issues/16069</a>)</li>
</ul>

Khoa
<p>First of all, if you run all the applications in AKS with the Istio, I will suggest you install the Istio following the steps that AKS provide in <a href="https://learn.microsoft.com/en-us/azure/aks/istio-install" rel="nofollow noreferrer">Install and use Istio in Azure Kubernetes Service (AKS)</a>.</p>

<p>Now, take a look at the example the AKS provided <a href="https://learn.microsoft.com/en-us/azure/aks/istio-scenario-routing" rel="nofollow noreferrer">here</a> and there is something you need to know:</p>

<blockquote>
  <p>The Istio has the proxy itself. So you need to choose which to use or
  use both proxies, but you need to make sure it supports two proxies.</p>
</blockquote>

<p>And if you use the proxy of Istio, then you also need to enable the <code>istio-injection</code> for the namespace of your application just like the example:</p>

<pre><code>kubectl label namespace voting istio-injection=enabled 
</code></pre>

<p>This label instructs Istio to automatically inject the istio-proxies as sidecars into all of your pods in this namespace. And you should use the right gateway for your virtual service in the ingress.yaml.</p>
