<p>I have managed to get going with Istio. I've been testing a lot of the fundamentals and have a basic cluster working nicely with HTTP and gRPC. I have a Service that however needs to make an internal request to another service that isn't externally exposed.</p>

<p>So take this example:</p>

<ol>
<li>Request comes in from an Istio gateway as HTTP</li>
<li>My custom grpc-gateway handler proxies the request to a gRPC service</li>
<li>The gateway responds to the user via HTTP</li>
</ol>

<p>I have a Gateway and a VirtualService declared:</p>

<pre><code>apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: my-ingress
spec:
  hosts:
  - "*"
  gateways:
  - my-gateway
  http:
  - match:
    - port: 80
    route:
    - destination:
        host: my-grpc-gateway.default.svc.cluster.local
    corsPolicy:
      allowOrigin:
      - "*"
      allowMethods:
      - POST
      - GET
      - DELETE
      - PUT
      - OPTIONS
      allowCredentials: false
      allowHeaders:
      - Authorization
      maxAge: "24h"
  - match:
    - port: 30051
    route:
    - destination:
        host: api.default.svc.cluster.local
        port:
          number: 8443
</code></pre>

<p>And here's my gateway:</p>

<pre><code>apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: my-gateway
spec:
  selector:
    istio: ingressgateway
  servers:
  - port:
      name: http
      number: 80
      protocol: HTTP
    tls:
      mode: PASSTHROUGH
    hosts:
    - "*"
  - port:
      name: https
      number: 443
      protocol: HTTPS
    tls:
      mode: PASSTHROUGH
    hosts:
    - "*"
  - port:
      name: grpc
      number: 30051
      protocol: GRPC
    tls:
      mode: PASSTHROUGH
    hosts:
    - "*"
</code></pre>

<p>My proxy service is being provided with the coordinates of the gRPC server:</p>

<pre><code>apiVersion: apps/v1
kind: Deployment
metadata:
  name: rest-proxy
  labels:
    app: prox
spec:
  replicas: 1
  selector:
    matchLabels:
      app: rest-proxy
  template:
    metadata:
      labels:
        app: rest-proxy
    spec:
      containers:
        - image: redacted/rest-proxy:latest
          name: rest-proxy
          ports:
            - containerPort: 80
          command: ["./rest-proxy"]
          args: ["-host", "0.0.0.0", "-port", "80", "-apipath", "$(API_SERVICE_HOST):$(API_SERVICE_PORT)"]
      imagePullSecrets:
      - name: regcred
---
apiVersion: v1
kind: Service
metadata:
  name: rest-proxy
  labels:
    app: rest-proxy
spec:
  ports:
  - name: http
    port: 80
  - name: grpc-port
    port: 8444
  selector:
   app: rest-proxy
</code></pre>

<p>Is this where a ServiceEntry resource comes into play? For now I just want to make sure my internal services can talk to each other, eventually I'll create a load balancer to handle proxying from the gateway to the API (as I scale out).</p>

<p>Any suggestions/guidance would be helpful!</p>

ddibiase
<p>After much more digging I realized that my proxy service was binding to the port: API_SERVICE_PORT which was set to 8080. The gRPC service existed at 8443, so the connection was never made.</p>

<p>All internal services within the mesh should naturally talk to each other. It's only the ingress that needs explicit rules to come into the mesh.</p>
