<p>Learning k8s + istio here. I've setup a 2 nodes + 1 master cluster with <code>kops</code>. I have Istio as ingress controller. I'm trying to set up OIDC Auth for a dummy nginx service. I'm hitting a super weird bug I have no idea where it's coming from.</p>

<p>So, I have a</p>

<ol>
<li>Keycloak service </li>
<li>Nginx service</li>
</ol>

<p>The <code>keycloak</code> service runs on <code>keycloak.example.com</code>
The <code>nginx</code> service runs on <code>example.com</code></p>

<p>There is a Classic ELB on AWS to serve that. 
There are Route53 DNS records for</p>

<pre><code>ALIAS example.com          dualstack.awdoijawdij.amazonaws.com
ALIAS keycloak.example.com dualstack.awdoijawdij.amazonaws.com
</code></pre>

<p>When I was setting up the keycloak service, and there was only that service, I had no problem. But when I added the dummy nginx service, I started getting this.</p>

<p>I would use firefox to go to keycloak.example.com, and get a 404. If I do a hard refresh, then the page loads. </p>

<p>Then I would go to example.com, and would get a 404. If I do a hard refresh, then the page loads.</p>

<p>If I do a hard refresh on one page, then when I go to the other page, I will have to do a hard reload or I get a 404. It's like some DNS entry is toggling between these two things whenever I do the hard refresh. I have no idea on how to debug this.</p>

<p>If I </p>

<ul>
<li><code>wget -O- example.com</code> I have a <code>301 redirect</code> to <code>https://example.com</code> as expected</li>
<li><code>wget -O- https://example.com</code> I have a <code>200 OK</code> as expected</li>
<li><code>wget -O- keycloak.example.com</code> I have a <code>301 redirect</code> to <code>https://keycloak.example.com</code> as expected</li>
<li><code>wget -O- https://keycloak.example.com</code> I have a <code>200 OK</code> as expected</li>
</ul>

<p>Then everything is fine. Seems like the problem only occurs in the browser.</p>

<p>I tried opening the pages in Incognito mode, but the problem persists. </p>

<p>Can someone help me in debugging this?</p>

<pre><code>apiVersion: apps/v1
kind: Deployment
metadata:
  name: nginx-deployment
  labels:
    app: nginx
spec:
  replicas: 2
  selector:
    matchLabels:
      app: nginx
  template:
    metadata:
      labels:
        app: nginx
    spec:
      containers:
        - name: nginx
          image: nginx:latest
          ports:
            - containerPort: 80
---
apiVersion: v1
kind: Service
metadata:
  name: nginx
spec:
  ports:
    - port: 80
      name: http
      protocol: TCP
  selector:
    app: nginx
---
apiVersion: networking.istio.io/v1beta1
kind: Gateway
metadata:
  name: nginx-gateway
spec:
  selector:
    istio: ingressgateway
  servers:
    - port:
        number: 80
        name: http
        protocol: HTTP
      tls:
        httpsRedirect: true
      hosts:
        - "example.com"
    - port:
        number: 443
        name: https
        protocol: HTTPS
      tls:
        mode: SIMPLE
        credentialName: ingress-cert
      hosts:
        - "example.com"
---
apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: nginx
spec:
  hosts:
    - "example.com"
  gateways:
    - nginx-gateway
  http:
    - route:
        - destination:
            port:
              number: 80
            host: nginx
---
apiVersion: networking.istio.io/v1beta1
kind: Gateway
metadata:
  name: keycloak-gateway
spec:
  selector:
    istio: ingressgateway
  servers:
    - port:
        number: 80
        name: http
        protocol: HTTP
      tls:
        httpsRedirect: true
      hosts:
        - "keycloak.example.com"
    - port:
        number: 443
        name: https
        protocol: HTTPS
      tls:
        mode: SIMPLE
        credentialName: ingress-cert
      hosts:
        - "keycloak.example.com"
---
apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: keycloak
spec:
  hosts:
    - "keycloak.example.com"
  gateways:
    - keycloak-gateway
  http:
    - route:
        - destination:
            port:
              number: 80
            host: keycloak-http
</code></pre>

Ludovic C
<p>The problem was that I was using the same certificate for both Gateways, hence resulting in keeping the same tcp connection for both services.</p>

<p>There is a discussion about it here <a href="https://github.com/istio/istio/issues/9429" rel="nofollow noreferrer">https://github.com/istio/istio/issues/9429</a></p>

<p>By using a different certificate for both Gateway ports, the problem disappears</p>
