Istio VirtualService HTTP header match issue - istio

Question

The following Istio 0.8 VirtualService fails to match the HTTP header.
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
name: reviews
spec:
hosts:
- reviews
http:
- match:
- headers:
foo:
exact: bar
route:
- destination:
host: reviews
subset: v2
- route:
- destination:
host: reviews
subset: v3
I have followed https://github.com/istio/issues/issues/38 and Istio RouteRule based on headers user-agent doesn't work. However am unable to get it to function.
Pointers would be really helpful as the sleep service returns the product page similar to POSTMAN with no implication of the match condition!

Answer 1

This VirtualService by itself won't work if you don't have a DestinationRule to define your subsets (versions).
I will demonstrate how it should be done with the HelloWorld sample that is packed with the 0.8 release:
Step 1: Deploy the samples/helloworld/helloworld.yaml
Step 2: Define a DestinationRule for the two available versions:
apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
name: helloworld
spec:
host: helloworld
subsets:
- name: v1
labels:
version: v1
- name: v2
labels:
version: v2
Step 3: Replace the default VirtualService with the one that matches header attribute for routing:
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
name: helloworld
spec:
hosts:
- "*"
gateways:
- helloworld-gateway
http:
- match:
- headers:
foo:
exact: bar
route:
- destination:
host: helloworld
subset: v2
- route:
- destination:
host: helloworld
subset: v1
Step 4: Test it:
Without header: curl http://$INGRESS_GATEWAY/hello
Output:
Hello version: v1, instance: helloworld-v1-fd9b784bb-wcnj9
With header: curl -H "foo: bar" http://$INGRESS_GATEWAY/hello
Output:
Hello version: v2, instance: helloworld-v2-56694b7d6d-gbhqb

Answer 2

You need to call the reviews service through the ingressgateway. If you aren't doing that, there are two ways you could be hitting a problem:
If you are calling productpage (curl <ingress url>/productpage -H "foo: bar"), there is not any logic to propagate the foo: bar header from productpage to the reviews service. The example with the user-agent works because the user-agent is automatically propagated (a special case). If you want to use foo: bar, you would have to add logic to the productpage service to grab the foo header and send it on to the reviews service.
You are calling the reviews service directly (for instance, you gave the reviews service a node port). This would fail because your request is not being routed by an Istio proxy --instead it is being handled by the k8s service load balancer. You need to call an Istio proxy, like the ingressgateway.