<p>I have an application with an Ingress resource shown below.</p>

<pre><code>apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: {{ $fullName }}-stateful
  labels: 
    app: oxauth
  annotations:
    kubernetes.io/ingress.class: "nginx"
    nginx.org/ssl-services: "oxtrust"
    nginx.ingress.kubernetes.io/app-root: "/identity"
    nginx.ingress.kubernetes.io/affinity: "cookie"
    nginx.ingress.kubernetes.io/session-cookie-name: "route"
    nginx.ingress.kubernetes.io/session-cookie-hash: "sha1"
    nginx.ingress.kubernetes.io/proxy-next-upstream: "error timeout invalid_header http_500 http_502 http_503 http_504"
spec:
{{- if .Values.ingress.tls }}
  tls:
  {{- range .Values.ingress.tls }}
    - hosts:
      {{- range .hosts }}
        - {{ . | quote }}
      {{- end }}
      secretName: {{ .secretName }}
  {{- end }}
{{- end }}
  rules:
  {{- range .Values.ingress.hosts }}
    - host: {{ . | quote }}
      http:
        paths:
          - path: /identity
            backend:
              serviceName: oxtrust
              servicePort: 8080
          - path: /idp
            backend:
              serviceName: oxshibboleth
              servicePort: 8080
          - path: /passport
            backend:
              serviceName: oxpassport
              servicePort: 8090
</code></pre>

<p>I would like to translate that into a <code>VirtualService</code> to be used by Istio gateway. But once I do that the service <code>oxpassport</code> always returns a <code>503</code> error in the logs. That means the deployment can't be reached.</p>

<p>Below is the <code>Service</code> definition </p>

<pre><code>apiVersion: v1
kind: Service
metadata:
  creationTimestamp: "2020-04-15T18:21:12Z"
  labels:
    app: oxpassport
    app.kubernetes.io/instance: kk
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/version: 4.1.0_01
    helm.sh/chart: oxpassport-1.0.0
  name: oxpassport
  namespace: test
spec:
  clusterIP: 10.111.71.120
  ports:
  - name: tcp-oxpassport
    port: 8090
    protocol: TCP
    targetPort: 8090
  selector:
    app: oxpassport
    release: kk
  type: ClusterIP
status:
  loadBalancer: {}
</code></pre>

<p>And finally the <code>VS</code> I am trying to use:</p>

<p><code>VirtualService</code></p>

<pre><code>apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: {{ include "istio.fullname" . }}-oxpassport
  namespace: {{ .Release.Namespace }}
spec:
  hosts:
    - oxpassport.{{ .Release.Namespace }}.svc.cluster.local
  gateways:
    - {{ .Release.Name }}-global-gtw
  http:
  - match:
    - uri:
        prefix: /passport
    rewrite:
      uri: /identity
    route:
    - destination:
        host: oxpassport.{{ .Release.Namespace }}.svc.cluster.local
        port:
          number: 8090
</code></pre>

<p><code>Gateway</code> snippet:</p>

<pre><code>  - port:
      number: 8090
      name: tcp-oxpassport
      protocol: HTTP
    hosts:
    - oxpassport.{{ .Release.Namespace }}.svc.cluster.local
</code></pre>

<p>Things to note:</p>

<ol>
<li><p>There is a backend app with these labels. And that has it's own VS and it's working:</p>

<pre><code> labels: 
    app: oxauth
</code></pre></li>
<li><p>Oxpassport has a deployment with labels</p>

<pre><code>  labels: 
     app: oxpassport
</code></pre></li>
</ol>

<p>I know it's a long post but it's a blocker for quite some days now. If it is possible, please explain.</p>

<p>Thanks</p>

Shammir
<p>Gateway should be in the same namespace as virtual service, if it´s not in the same namespace as virtual service, you should add it like in below example.</p>

<p>Check the <code>spec.gateways</code> section</p>

<pre><code>apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: bookinfo-Mongo
  namespace: bookinfo-namespace
spec:
  gateways:
  - some-namespace/my-gateway 
</code></pre>

<hr>

<p>In your ingress you have 3 paths then virtual service based on that ingress should look like there</p>

<pre><code>apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: {{ include "istio.fullname" . }}-oxpassport
  namespace: {{ .Release.Namespace }}
spec:
  hosts:
    - oxpassport.{{ .Release.Namespace }}.svc.cluster.local
  gateways:
    - {{ .Release.Name }}-global-gtw
  http:
  - name: a
    match:
    - uri:
        prefix: /identity
    route:
    - destination:
        host: oxtrust.{{ .Release.Namespace }}.svc.cluster.local
        port:
          number: 8080
  - name: b
    match:
    - uri:
        prefix: /idp
    route:
    - destination:
        host: oxshibboleth.{{ .Release.Namespace }}.svc.cluster.local
        port:
          number: 8080
  - name: c
    match:
    - uri:
        prefix: /passport
    route:
    - destination:
        host: oxpassport.{{ .Release.Namespace }}.svc.cluster.local
        port:
          number: 8090  
</code></pre>

<hr>

<p>Cases with answers worth to check when problem 503 appears.</p>

<ul>
<li><p><a href="https://istio.io/docs/ops/common-problems/network-issues/#503-errors-after-setting-destination-rule" rel="nofollow noreferrer">https://istio.io/docs/ops/common-problems/network-issues/#503-errors-after-setting-destination-rule</a></p></li>
<li><p><a href="https://stackoverflow.com/questions/54160215/accessing-service-using-istio-ingress-gives-503-error-when-mtls-is-enabled?rq=1">Accessing service using istio ingress gives 503 error when mTLS is enabled</a></p></li>
<li><p><a href="https://istio.io/docs/ops/best-practices/traffic-management/#avoid-503-errors-while-reconfiguring-service-routes" rel="nofollow noreferrer">https://istio.io/docs/ops/best-practices/traffic-management/#avoid-503-errors-while-reconfiguring-service-routes</a></p></li>
<li><p><a href="https://stackoverflow.com/questions/59560394/how-to-terminate-ssl-at-ingress-gateway-in-istio">how to terminate ssl at ingress-gateway in istio?</a></p></li>
<li><p><a href="https://stackoverflow.com/questions/57638780/kubernetes-istio-ingress-gateway-responds-with-503-always">Kubernetes Istio ingress gateway responds with 503 always</a></p></li>
</ul>

<hr>

<p><strong>EDIT</strong></p>

<hr>

<blockquote>
  <p>Did you consider this nginx.ingress.kubernetes.io/app-root: "/identity"?</p>
</blockquote>

<p>Missed that /identity app root, you can always rewrite all of them like you did. </p>

<blockquote>
  <p>Also, is there a particular reason why we can separate that whole - big - vs into different VS files?</p>
</blockquote>

<p>No, you should be able to create seperate smaller virtual services instead of the big one, I just copied the ingress you provided.</p>
