title: Translating Ingress resource to Istio VirtualService or ServiceEntry
body: <p>I have an application with an Ingress resource shown below.</p>
  
  <pre><code>apiVersion: extensions/v1beta1
  kind: Ingress
  metadata:
    name: {{ $fullName }}-stateful
    labels: 
      app: oxauth
    annotations:
      kubernetes.io/ingress.class: "nginx"
      nginx.org/ssl-services: "oxtrust"
      nginx.ingress.kubernetes.io/app-root: "/identity"
      nginx.ingress.kubernetes.io/affinity: "cookie"
      nginx.ingress.kubernetes.io/session-cookie-name: "route"
      nginx.ingress.kubernetes.io/session-cookie-hash: "sha1"
      nginx.ingress.kubernetes.io/proxy-next-upstream: "error timeout invalid_header http_500 http_502 http_503 http_504"
  spec:
  {{- if .Values.ingress.tls }}
    tls:
    {{- range .Values.ingress.tls }}
      - hosts:
        {{- range .hosts }}
          - {{ . | quote }}
        {{- end }}
        secretName: {{ .secretName }}
    {{- end }}
  {{- end }}
    rules:
    {{- range .Values.ingress.hosts }}
      - host: {{ . | quote }}
        http:
          paths:
            - path: /identity
              backend:
                serviceName: oxtrust
                servicePort: 8080
            - path: /idp
              backend:
                serviceName: oxshibboleth
                servicePort: 8080
            - path: /passport
              backend:
                serviceName: oxpassport
                servicePort: 8090
  </code></pre>
  
  <p>I would like to translate that into a <code>VirtualService</code> to be used by Istio gateway. But once I do that the service <code>oxpassport</code> always returns a <code>503</code> error in the logs. That means the deployment can't be reached.</p>
  
  <p>Below is the <code>Service</code> definition </p>
  
  <pre><code>apiVersion: v1
  kind: Service
  metadata:
    creationTimestamp: "2020-04-15T18:21:12Z"
    labels:
      app: oxpassport
      app.kubernetes.io/instance: kk
      app.kubernetes.io/managed-by: Helm
      app.kubernetes.io/version: 4.1.0_01
      helm.sh/chart: oxpassport-1.0.0
    name: oxpassport
    namespace: test
  spec:
    clusterIP: 10.111.71.120
    ports:
    - name: tcp-oxpassport
      port: 8090
      protocol: TCP
      targetPort: 8090
    selector:
      app: oxpassport
      release: kk
    type: ClusterIP
  status:
    loadBalancer: {}
  </code></pre>
  
  <p>And finally the <code>VS</code> I am trying to use:</p>
  
  <p><code>VirtualService</code></p>
  
  <pre><code>apiVersion: networking.istio.io/v1alpha3
  kind: VirtualService
  metadata:
    name: {{ include "istio.fullname" . }}-oxpassport
    namespace: {{ .Release.Namespace }}
  spec:
    hosts:
      - oxpassport.{{ .Release.Namespace }}.svc.cluster.local
    gateways:
      - {{ .Release.Name }}-global-gtw
    http:
    - match:
      - uri:
          prefix: /passport
      rewrite:
        uri: /identity
      route:
      - destination:
          host: oxpassport.{{ .Release.Namespace }}.svc.cluster.local
          port:
            number: 8090
  </code></pre>
  
  <p><code>Gateway</code> snippet:</p>
  
  <pre><code>  - port:
        number: 8090
        name: tcp-oxpassport
        protocol: HTTP
      hosts:
      - oxpassport.{{ .Release.Namespace }}.svc.cluster.local
  </code></pre>
  
  <p>Things to note:</p>
  
  <ol>
  <li><p>There is a backend app with these labels. And that has it's own VS and it's working:</p>
  
  <pre><code> labels: 
      app: oxauth
  </code></pre></li>
  <li><p>Oxpassport has a deployment with labels</p>
  
  <pre><code>  labels: 
       app: oxpassport
  </code></pre></li>
  </ol>
  
  <p>I know it's a long post but it's a blocker for quite some days now. If it is possible, please explain.</p>
  
  <p>Thanks</p>