<p>I'm configuring Istio using Helm. Here you can find my <code>istio-config.yaml</code>:</p>

<pre><code>global:
  proxy:
    accessLogFile: "/dev/stdout"
    resources:
      requests:
        cpu: 10m
        memory: 40Mi

  disablePolicyChecks: false

sidecarInjectorWebhook:
  enabled: true
  rewriteAppHTTPProbe: false

pilot:
  autoscaleEnabled: false
  traceSampling: 100.0
  resources:
    requests:
      cpu: 10m
      memory: 100Mi

mixer:
  policy:
    enabled: true
    autoscaleEnabled: false
    resources:
      requests:
        cpu: 10m
        memory: 100Mi

  telemetry:
    enabled: true
    autoscaleEnabled: false
    resources:
      requests:
        cpu: 50m
        memory: 100Mi

  adapters:
    stdio:
      enabled: true

grafana:
  enabled: true

tracing:
  enabled: true

kiali:
  enabled: true
  createDemoSecret: true

gateways:
  istio-ingressgateway:
    autoscaleEnabled: false
    resources:
      requests:
        cpu: 10m
        memory: 40Mi

  istio-egressgateway:
    enabled: true
    autoscaleEnabled: false
    resources:
      requests:
        cpu: 10m
        memory: 40Mi

global:
  controlPlaneSecurityEnabled: false

  mtls:
    enabled: false

</code></pre>

<p>Then I deployed a bunch of microservices using <code>istioctl</code>, all of them are simple <code>REST</code> call using HTTP. They can communicate with each other without any issue. If I exposed them with NodePorts I can reach and communicate with them correctly.</p>

<p>Here are my Services:</p>

<pre><code>$ kubectl get svc --all-namespaces
NAMESPACE              NAME                             TYPE           CLUSTER-IP       EXTERNAL-IP   PORT(S)                                                                                                                                      AGE
default                activemq                         ClusterIP      None             &lt;none&gt;        61616/TCP                                                                                                                                    3h17m
default                activemq-np                      NodePort       10.110.76.147    &lt;none&gt;        8161:30061/TCP                                                                                                                               3h17m
default                api-exchange                     ClusterIP      None             &lt;none&gt;        8080/TCP                                                                                                                                     3h16m
default                api-response                     ClusterIP      None             &lt;none&gt;        8080/TCP                                                                                                                                     3h16m
default                authorization-server             ClusterIP      None             &lt;none&gt;        8080/TCP                                                                                                                                     3h17m
default                de-communication                 ClusterIP      None             &lt;none&gt;        8080/TCP                                                                                                                                     3h16m
default                gateway                          ClusterIP      None             &lt;none&gt;        8080/TCP                                                                                                                                     3h17m
default                gateway-np                       NodePort       10.96.123.57     &lt;none&gt;        8080:30080/TCP                                                                                                                               3h17m
default                identity                         ClusterIP      None             &lt;none&gt;        88/TCP,8080/TCP                                                                                                                              3h18m
default                kubernetes                       ClusterIP      10.96.0.1        &lt;none&gt;        443/TCP                                                                                                                                      3h19m
default                matchengine                      ClusterIP      None             &lt;none&gt;        8080/TCP                                                                                                                                     3h16m
default                monitor-redis                    ClusterIP      None             &lt;none&gt;        8081/TCP                                                                                                                                     3h17m
default                monitor-redis-np                 NodePort       10.106.178.13    &lt;none&gt;        8081:30082/TCP                                                                                                                               3h17m
default                postgres                         ClusterIP      None             &lt;none&gt;        5432/TCP                                                                                                                                     3h18m
default                postgres-np                      NodePort       10.106.223.216   &lt;none&gt;        5432:30032/TCP                                                                                                                               3h18m
default                redis                            ClusterIP      None             &lt;none&gt;        6379/TCP                                                                                                                                     3h18m
default                redis-np                         NodePort       10.101.167.194   &lt;none&gt;        6379:30079/TCP                                                                                                                               3h18m
default                synchronization                  ClusterIP      None             &lt;none&gt;        8080/TCP                                                                                                                                     3h15m
default                tx-flow                          ClusterIP      None             &lt;none&gt;        8080/TCP                                                                                                                                     3h15m
default                tx-manager                       ClusterIP      None             &lt;none&gt;        8080/TCP                                                                                                                                     3h15m
default                tx-scheduler                     ClusterIP      None             &lt;none&gt;        8080/TCP                                                                                                                                     3h15m
default                ubc-config                       ClusterIP      None             &lt;none&gt;        8080/TCP                                                                                                                                     3h16m
default                ubc-services-config              ClusterIP      None             &lt;none&gt;        8888/TCP                                                                                                                                     3h18m
default                ubc-services-config-np           NodePort       10.110.11.213    &lt;none&gt;        8888:30088/TCP                                                                                                                               3h18m
default                user-admin                       ClusterIP      None             &lt;none&gt;        8080/TCP                                                                                                                                     3h17m
default                web-exchange-np                  NodePort       10.105.244.194   &lt;none&gt;        80:30081/TCP                                                                                                                                 3h15m
istio-system           grafana                          ClusterIP      10.97.134.230    &lt;none&gt;        3000/TCP                                                                                                                                     3h22m
istio-system           istio-citadel                    ClusterIP      10.99.159.56     &lt;none&gt;        8060/TCP,15014/TCP                                                                                                                           3h22m
istio-system           istio-egressgateway              ClusterIP      10.97.71.204     &lt;none&gt;        80/TCP,443/TCP,15443/TCP                                                                                                                     3h22m
istio-system           istio-galley                     ClusterIP      10.98.111.27     &lt;none&gt;        443/TCP,15014/TCP,9901/TCP                                                                                                                   3h22m
istio-system           istio-ingressgateway             LoadBalancer   10.96.182.202    &lt;pending&gt;     15020:30936/TCP,80:31380/TCP,443:31390/TCP,31400:31400/TCP,15029:31913/TCP,15030:30606/TCP,15031:32127/TCP,15032:30362/TCP,15443:31416/TCP   3h22m
istio-system           istio-pilot                      ClusterIP      10.101.117.169   &lt;none&gt;        15010/TCP,15011/TCP,8080/TCP,15014/TCP                                                                                                       3h22m
istio-system           istio-policy                     ClusterIP      10.97.247.54     &lt;none&gt;        9091/TCP,15004/TCP,15014/TCP                                                                                                                 3h22m
istio-system           istio-sidecar-injector           ClusterIP      10.101.219.141   &lt;none&gt;        443/TCP                                                                                                                                      3h22m
istio-system           istio-telemetry                  ClusterIP      10.109.108.78    &lt;none&gt;        9091/TCP,15004/TCP,15014/TCP,42422/TCP                                                                                                       3h22m
istio-system           jaeger-agent                     ClusterIP      None             &lt;none&gt;        5775/UDP,6831/UDP,6832/UDP                                                                                                                   3h22m
istio-system           jaeger-collector                 ClusterIP      10.97.255.231    &lt;none&gt;        14267/TCP,14268/TCP                                                                                                                          3h22m
istio-system           jaeger-query                     ClusterIP      10.104.80.162    &lt;none&gt;        16686/TCP                                                                                                                                    3h22m
istio-system           kiali                            ClusterIP      10.104.41.71     &lt;none&gt;        20001/TCP                                                                                                                                    3h22m
istio-system           kiali-np                         NodePort       10.100.99.141    &lt;none&gt;        20001:30085/TCP                                                                                                                              29h
istio-system           prometheus                       ClusterIP      10.110.46.60     &lt;none&gt;        9090/TCP                                                                                                                                     3h22m
istio-system           tracing                          ClusterIP      10.111.173.205   &lt;none&gt;        80/TCP                                                                                                                                       3h22m
istio-system           zipkin                           ClusterIP      10.101.144.199   &lt;none&gt;        9411/TCP                                                                                                                                     3h22m
kube-system            kube-dns                         ClusterIP      10.96.0.10       &lt;none&gt;        53/UDP,53/TCP,9153/TCP                                                                                                                       54d
kube-system            tiller-deploy                    ClusterIP      10.105.162.195   &lt;none&gt;        44134/TCP                                                                                                                                    24d
</code></pre>

<p>I created an ingress gateway and one VirtualService to route calls from outside the cluster. Here are my gateway and Virtual Services configurations:</p>

<p>Gateway:</p>

<pre><code>$ kubectl describe gateway iris-gateway
Name:         iris-gateway
Namespace:    default
Labels:       &lt;none&gt;
Annotations:  kubectl.kubernetes.io/last-applied-configuration:
                {"apiVersion":"networking.istio.io/v1alpha3","kind":"Gateway","metadata":{"annotations":{},"name":"iris-gateway","namespace":"default"},"s...
API Version:  networking.istio.io/v1alpha3
Kind:         Gateway
Metadata:
  Creation Timestamp:  2019-08-23T17:25:20Z
  Generation:          1
  Resource Version:    7093263
  Self Link:           /apis/networking.istio.io/v1alpha3/namespaces/default/gateways/iris-gateway
  UID:                 4c4fac7d-a698-4c9c-97e6-ebc7416c96a8
Spec:
  Selector:
    Istio:  ingressgateway
  Servers:
    Hosts:
      *
    Port:
      Name:      http
      Number:    80
      Protocol:  HTTP
Events:          &lt;none&gt;
</code></pre>

<p>Virtual Services:</p>

<pre><code>$ kubectl describe virtualservice apiexg
Name:         apiexg
Namespace:    default
Labels:       &lt;none&gt;
Annotations:  kubectl.kubernetes.io/last-applied-configuration:
                {"apiVersion":"networking.istio.io/v1alpha3","kind":"VirtualService","metadata":{"annotations":{},"name":"apiexg","namespace":"default"},"...
API Version:  networking.istio.io/v1alpha3
Kind:         VirtualService
Metadata:
  Creation Timestamp:  2019-08-23T19:26:16Z
  Generation:          1
  Resource Version:    7107510
  Self Link:           /apis/networking.istio.io/v1alpha3/namespaces/default/virtualservices/apiexg
  UID:                 861bca0d-be98-4bfb-bf92-b2bd2f1b703f
Spec:
  Gateways:
    iris-gateway
  Hosts:
    *
  Http:
    Match:
      Uri:
        Prefix:  /api-exchange
    Route:
      Destination:
        Host:  api-exchange.default.svc.cluster.local
        Port:
          Number:  8080
Events:            &lt;none&gt;
</code></pre>

<p>When I make a call to the service I always got a 503 Service Unavailable:</p>

<pre><code>curl -X POST http://172.30.7.129:31380/api-exchange/ -vvv
* About to connect() to 172.30.7.129 port 31380 (#0)
*   Trying 172.30.7.129...
* Connected to 172.30.7.129 (172.30.7.129) port 31380 (#0)
&gt; POST /api-exchange/ HTTP/1.1
&gt; User-Agent: curl/7.29.0
&gt; Host: 172.30.7.129:31380
&gt; Accept: */*
&gt; 
&lt; HTTP/1.1 503 Service Unavailable
&lt; content-length: 19
&lt; content-type: text/plain
&lt; date: Fri, 23 Aug 2019 21:49:33 GMT
&lt; server: istio-envoy
&lt; 
* Connection #0 to host 172.30.7.129 left intact
no healthy upstream
</code></pre>

<p>Here is log output for <code>istio-ingressgateway</code> pod:</p>

<pre><code>[2019-08-23 21:49:34.185][38][warning][upstream] [external/envoy/source/common/upstream/original_dst_cluster.cc:110] original_dst_load_balancer: No downstream connection or no original_dst.
</code></pre>

<p>Versions:</p>

<pre><code>$ istioctl version --remote
client version: 1.2.4
citadel version: 1.2.4
egressgateway version: 94746ccd404a8e056483dd02e4e478097b950da6-dirty
galley version: 1.2.4
ingressgateway version: 94746ccd404a8e056483dd02e4e478097b950da6-dirty
pilot version: 1.2.4
policy version: 1.2.4
sidecar-injector version: 1.2.4
telemetry version: 1.2.4

$ kubectl version
Client Version: version.Info{Major:"1", Minor:"15", GitVersion:"v1.15.1", GitCommit:"4485c6f18cee9a5d3c3b4e523bd27972b1b53892", GitTreeState:"clean", BuildDate:"2019-07-18T09:18:22Z", GoVersion:"go1.12.5", Compiler:"gc", Platform:"linux/amd64"}
Server Version: version.Info{Major:"1", Minor:"15", GitVersion:"v1.15.0", GitCommit:"e8462b5b5dc2584fdcd18e6bcfe9f1e4d970a529", GitTreeState:"clean", BuildDate:"2019-06-19T16:32:14Z", GoVersion:"go1.12.5", Compiler:"gc", Platform:"linux/amd64"}
</code></pre>

<p>Istio installation:</p>

<pre><code>$ helm install /opt/istio-1.2.4/install/kubernetes/helm/istio-init --name istio-init --namespace istio-system
$ helm install /opt/istio-1.2.4/install/kubernetes/helm/istio --name istio --namespace istio-system --values istio-config/istio-config.yaml
</code></pre>

<p>Environment:</p>

<p>I did the same configuration over a Oracle Virtual Appliance Virtual Server with RHEL 7 and over a cluster of 3 Physical Servers with RHEL 7.</p>

Miguel Resendiz
<p>I solve this problem. istio-gateway was not capable to do redirect due to one of my services have a <code>ClusterIP</code> assigned:</p>

<pre><code>$ kubectl get svc --all-namespaces
NAMESPACE              NAME                             TYPE           CLUSTER-IP       EXTERNAL-IP   PORT(S)                                                                                                                                      AGE
default                activemq                         ClusterIP      None             &lt;none&gt;        61616/TCP                                                                                                                                    3h17m
default                api-exchange                     ClusterIP      None             &lt;none&gt;        8080/TCP                                                                                                                                     3h16m
default                api-response                     ClusterIP      None             &lt;none&gt;        8080/TCP                                                                                                                                     3h16m
default                authorization-server             ClusterIP      None             &lt;none&gt;        8080/TCP                                                                                                                                     3h17m
default                de-communication                 ClusterIP      None             &lt;none&gt;        8080/TCP                                                                                                                                     3h16m
default                gateway                          ClusterIP      None             &lt;none&gt;        8080/TCP                                                                                                                                     3h17m
default                identity                         ClusterIP      None             &lt;none&gt;        88/TCP,8080/TCP                                                                                                                              3h18m
default                kubernetes                       ClusterIP      10.96.0.1        &lt;none&gt;        443/TCP                                                                                                                                      3h19m
default                matchengine                      ClusterIP      None             &lt;none&gt;        8080/TCP                                                                                                                                     3h16m
default                monitor-redis                    ClusterIP      None             &lt;none&gt;        8081/TCP                                                                                                                                     3h17m
default                postgres                         ClusterIP      None             &lt;none&gt;        5432/TCP                                                                                                                                     3h18m
default                redis                            ClusterIP      None             &lt;none&gt;        6379/TCP                                                                                                                                     3h18m
default                synchronization                  ClusterIP      None             &lt;none&gt;        8080/TCP                                                                                                                                     3h15m
default                tx-flow                          ClusterIP      None             &lt;none&gt;        8080/TCP                                                                                                                                     3h15m
default                tx-manager                       ClusterIP      None             &lt;none&gt;        8080/TCP                                                                                                                                     3h15m
default                tx-scheduler                     ClusterIP      None             &lt;none&gt;        8080/TCP                                                                                                                                     3h15m
default                ubc-config                       ClusterIP      None             &lt;none&gt;        8080/TCP                                                                                                                                     3h16m
default                ubc-services-config              ClusterIP      None             &lt;none&gt;        8888/TCP                                                                                                                                     3h18m
default                user-admin                       ClusterIP      None             &lt;none&gt;        8080/TCP                                                                                                                                     3h17m
</code></pre>

<p>Here one of my YAML with <code>ClusterIP: None</code>:</p>

<pre><code>apiVersion: v1
kind: Service
metadata:
  name: ubc-config
  labels:
    app: ubc-config
spec:
  clusterIP: None
  ports:
  - port: 8080
    name: ubc-config
  selector:
    app: ubc-config
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: ubc-config
spec:
  selector:
    matchLabels:
      app: ubc-config
  replicas: 1
  template:
    metadata:
      labels:
        app: ubc-config
    spec:
      containers:
      - name: ubc-config
        image: ubc-config
        ports:
        - containerPort: 8080
</code></pre>

<p>As you can see, <code>Service.spec.ClusterIP</code> is set to <code>NONE</code>. To solve the problem I only change my YAML configuration to:</p>

<pre><code>apiVersion: v1
kind: Service
metadata:
  name: ubc-config
  labels:
    app: ubc-config
spec:
  ports:
  - port: 8080
    name: http-ubcconfig
  selector:
    app: ubc-config
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: ubc-config
spec:
  selector:
    matchLabels:
      app: ubc-config
  replicas: 1
  template:
    metadata:
      labels:
        app: ubc-config
    spec:
      containers:
      - name: ubc-config
        image: ubc-config
        ports:
        - containerPort: 8080
          name: http-ubcconfig
</code></pre>

<p>I hope this helps someone.</p>
