title: Istio gives 404 NR response when it should be giving 200
body: <h2>Related issue</h2>
  
  <p><a href="https://stackoverflow.com/questions/53188518/istio-envoy-is-dropping-requests-with-host-header">Istio envoy is dropping requests with Host header</a></p>
  
  <p>The above issue is the only one that's even remotely similar to my issue. However, the Host in my header is <code>service-b.myns.svc.cluster.local</code> and I don't see why that should be a problem.</p>
  
  <h2>The situation</h2>
  
  <p>I've got a namespace with many <code>Deployment</code>s and <code>Service</code>s. And for each <code>Service</code> I've also defined a <code>VirtualService</code>. Example:</p>
  
  <pre><code>apiVersion: networking.istio.io/v1alpha3
  kind: VirtualService
  metadata:
    labels:
      app: service-b
    name: service-b
    namespace: myns
  spec:
    gateways:
    - myns.myns.svc.cluster.local
    hosts:
    - '*'
    http:
    - match:
      - uri:
          prefix: /.well-known
      - uri:
          prefix: /robots.txt
      - uri:
          prefix: /apple-app-site-association
      - uri:
          prefix: /favicon.ico
      - uri:
          prefix: /content/
      route:
      - destination:
          host: service-b.myns.svc.cluster.local
          port:
            number: 80
  </code></pre>
  
  <h2>The problem</h2>
  
  <p>I have another service, call it <code>service-a</code> that should be able to retrieve <code>/.well-known</code>, <code>robots.txt</code>, <code>/content/header</code>, <code>/content/footer</code> etc. I'm assuming that, because I've defined a route for these paths to lead directly to <code>service-b</code>, they should be retrievable by <code>service-a</code>. However, the logs say this:</p>
  
  <pre><code>[2019-02-22T01:07:54.557Z] "GET /content/headerHTTP/1.1" 404 NR 0 0 0 - "-" "curl/7.52.1" "789b3b81-9f61-43c3-b01a-b66d35c1d635" "service-b" "-" - - 10.x.x.x:80 10.y.y.y:47526
  </code></pre>
  
  <h2>Question #1</h2>
  
  <p>Per the <a href="https://www.envoyproxy.io/docs/envoy/latest/configuration/access_log" rel="nofollow noreferrer">Envoy docs</a>, <code>NR</code> means no route. Have I not defined a route in my <code>VirtualService</code>?</p>
  
  <h2>Question #2</h2>
  
  <p>I can get a <code>200</code> response for each of those paths if I just plug them in to the URL bar in my browser (ie. <code>&lt;istio-ingressgateway-ip-address&gt;/robots.txt</code>). Why?</p>
  
  <h2>Some proggress</h2>
  
  <p>I've narrowed down the issue to the istio proxy on the pod for <code>service-a</code>. I did this by removing the istio-proxy sidecars one at a time. There are two cases in which I get successfull <code>200</code>s from <code>service-a</code>:</p>
  
  <pre><code>[SVCA][ISTIOPROXY] ---&gt; X [ISTIOPROXY][SVCB]  # Does not work
  [SVCA][ISTIOPROXY] ---&gt; X             [SVCB]  # Does not work
  [SVCA]             ---&gt; ✓             [SVCB]  # Does work
  [SVCA]             ---&gt; ✓ [ISTIOPROXY][SVCB]  # Does work
  </code></pre>