Diagnostic items for instance configurations

Abnormal example

In the following example, the VirtualService points to a gateway that does not exist:

apiVersion: networking.istio.io/v1
kind: Gateway
metadata:
  name: httpbin-gateway
spec:
  selector:
    istio: ingressgateway
  servers:
  - port:
      number: 80
      name: http2
      protocol: HTTP2
    hosts:
    - "*"
---
apiVersion: networking.istio.io/v1
kind: VirtualService
metadata:
  name: httpbin
spec:
  hosts:
  - "*"
  gateways:
  - httpbin-gateway-bogus # Should be "httpbin-gateway"
  http:
  - route:
    - destination:
        host: httpbin-gateway

You will receive this message:

Error [IST0101] (VirtualService httpbin.default) Referenced gateway not found: "httpbin-gateway-bogus"

How to fix

Find the resource type in the detailed error message and correct the reference in the Istio configuration.

Abnormal examples

In the following example, the productpage VirtualService in the team1 namespace conflicts with the custom VirtualService in the team2 namespace:

apiVersion: networking.istio.io/v1
kind: VirtualService
metadata:
  name: productpage
  namespace: team-1
spec:
  hosts:
  - productpage.default.svc.cluster.local
  http:
  - route:
    - destination:
        host: productpage
---
apiVersion: networking.istio.io/v1
kind: VirtualService
metadata:
  name: custom
  namespace: team-2
spec:
  hosts:
  - productpage.default.svc.cluster.local
  http:
  - route:
    - destination:
        host: productpage.team-2.svc.cluster.local
---

• Because a custom gateway is not specified, each virtual service is attached to the default "mesh" gateway.

• Both virtual services define the same host: productpage.default.svc.cluster.local.

How to fix

Use one of the following methods:

• Merge the conflicting virtual services into one.

• Use a unique hostname for each virtual service that is attached to the gateway.

• Scope the resource to a specific namespace by setting the exportTo field. For example:

  apiVersion: networking.istio.io/v1
  kind: VirtualService
  metadata:
    name: productpage
    namespace: team-1
  spec:
    exportTo:
    - "."
    hosts:
    - productpage.default.svc.cluster.local
    http:
    - route:
      - destination:
          host: productpage
  ---
  apiVersion: networking.istio.io/v1
  kind: VirtualService
  metadata:
    name: custom
    namespace: team-2
  spec:
    exportTo:
    - "."
    hosts:
    - productpage.default.svc.cluster.local
    http:
    - route:
      - destination:
          host: productpage.team-2.svc.cluster.local
  ---

Exception Examples

If a cluster contains the following AuthorizationPolicy:

apiVersion: security.istio.io/v1
kind: AuthorizationPolicy
metadata:
  name: httpbin-nopods
  namespace: httpbin
spec:
  selector:
    matchLabels:
      app: bogus-label # The label is incorrect. No matching workload is found.
      version: v1
  rules:
    - from:
        - source:
            principals: ["cluster.local/ns/default/sa/curl"]
        - source:
            namespaces: ["httpbin"]
      to:
        - operation:
            methods: ["GET"]
            paths: ["/info*"]
        - operation:
            methods: ["POST"]
            paths: ["/data"]
      when:
        - key: request.auth.claims[iss]
          values: ["https://accounts.google.com"]

You will receive this message:

Warning [IST0127] (AuthorizationPolicy httpbin-nopods.httpbin) No matching workloads for this resource with the following labels: app=bogus-label,version=v1

In this example, the httpbin-nopods AuthorizationPolicy resource selects pods with the app=bogus-label label, but no such pods exist.

How to fix

• Modify the selector to match an existing pod.

• Modify the labels of a pod to match the resource's selector.

Abnormal examples

If your cluster contains the following VirtualService and Gateway:

apiVersion: networking.istio.io/v1
kind: VirtualService
metadata:
  name: testing-service
  namespace: default
spec:
  gateways:
  - istio-system/testing-gateway
  hosts:
  - wrong.com
  http:
  - match:
    - uri:
        prefix: /
    route:
    - destination:
        host: ratings
---
apiVersion: networking.istio.io/v1
kind: Gateway
metadata:
  name: testing-gateway
  namespace: istio-system
spec:
  selector:
    istio: ingressgateway
  servers:
  - hosts:
    - testing.com
    port:
      name: http
      number: 80
      protocol: HTTP

You will receive the following message:

Warning [IST0132] (VirtualService testing-service.default testing.yaml:8) one or more host [wrong.com] defined in VirtualService default/testing-service not found in Gateway istio-system/testing-gateway.

In this example, the testing-service virtual service specifies the host wrong.com, but this host is not declared in the testing-gateway gateway.

How to fix

Ensure that all hosts defined in the virtual service are also defined in the hosts field of the corresponding gateway.

How to fix

Review the conflicting Telemetry resources and update their workload selectors to ensure that each pod matches only one Telemetry resource. You may need to adjust the label selectors or reorganize the Telemetry resources to eliminate the overlap.

How to fix

Review the conflicting Telemetry resources and add a unique workload selector to each one. This ensures that each Telemetry resource applies only to the intended set of pods, which resolves the ambiguity in the telemetry configuration.

Abnormal Example

For example, consider the following configuration:

# Gateway with an incorrect port definition

apiVersion: networking.istio.io/v1
kind: Gateway
metadata:
  name: istio-ingressgateway
spec:
  selector:
    istio: ingressgateway
  servers:
  - port:
      number: 80
      name: http
      protocol: HTTP
    hosts:
    - "*"
  - port:
      number: 8004
      name: http2
      protocol: HTTP
    hosts:
    - "*"
---

# Default gateway Service

apiVersion: v1
kind: Service
metadata:
  name: istio-ingressgateway
spec:
  selector:
    istio: ingressgateway
  ports:
  - name: status-port
    port: 15021
    protocol: TCP
    targetPort: 15021
  - name: http2
    port: 80
    protocol: TCP
    targetPort: 8080
  - name: https
    port: 443
    protocol: TCP
    targetPort: 8443

In this example, the GatewayPortNotDefinedOnService message appears because the configuration uses port 8004. However, the default IngressGateway, istio-ingressgateway, only listens on destination ports 15021, 8080, and 8443.

How to fix

Update the gateway configuration to use a valid port on the workload, and then retry.

The following is a corrected example:

# Gateway with a correct port definition

apiVersion: networking.istio.io/v1
kind: Gateway
metadata:
  name: istio-ingressgateway
spec:
  selector:
    istio: ingressgateway
  servers:
  - port:
      number: 8080
      name: http2
      protocol: HTTP
    hosts:
    - "*"
  - port:
      number: 8443
      name: https
      protocol: HTTP
    hosts:
    - "*"