Istio VirtualService delegate with mesh gateway

Question

I am implementing some routing logic for a set of internal services where a delegate VirtualService looks like a good solution:

https://istio.io/latest/docs/reference/config/networking/virtual-service/#Delegate

I created some test setup similar to the one in the documentation with only one difference. In my case, the "root" VirtualService bound to the "mesh" Gateway and the "host" is then some internal service name. Is this supposed to work or does delegation only work with non-mesh Gateways?

This is the root VirtualService (the idea is that all requests are sent to worker-pool.default.svc.cluster.local and depending on some HTTP headers they are then forwarded to other VirtualServices):

apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: worker-pool
spec:
  hosts:
  - worker-pool.default.svc.cluster.local
  http:
    - name: "route 1"
      match:
        - headers:
            customer-id:
              exact: alice
      delegate:
        name: worker-for-alice
    - name: "route 2"
      match:
        - headers:
            customer-id:
              exact: bob
      delegate:
        name: worker-for-bob

And here the other VirtualService (only showing one, both look the same):

apiVersion: v1
kind: Service
metadata:
  name: worker-for-alice
  labels:
    app: worker-for-alice
    service: worker-for-alice
spec:
  ...
---
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: worker-for-alice
spec:
  http:
  - route:
    - destination:
        host: worker-for-alice

Hey @F7502, Yes, delegate should work with mesh gateway. What is the output of curl -v worker-pool/? Could you try to change the delegate to route, so you would use single virtual service and check if it works? From my point of view delegate might not work with the headers, as it was made to work on uri, you can read more about it here. — Jakub

Márcio Andrada Márcio Andrada · Accepted Answer · 2021-04-16T08:32:18

I guess there are some points to consider:

As far as I am concerned, Delegate will only work for Gateways. So, you should need something like this:

spec:
  gateways:
  - mesh
  hosts:
  - worker-pool.default.svc.cluster.local
  http:
  ...

It is always a good idea to use namespaces. Once you have the items defined in namespaces, add "namespace" element to delegate definition:

      delegate:
        name: worker-for-bob
        namespace: <some-namespace>

Last, but not least, it may be necessary to setup variable PILOT_ENABLE_VIRTUAL_SERVICE_DELEGATE to "true" on istiod configuration:

kubectl edit deployment istiod -n istio-system

And then add this env variable in spec.template.spec.container.env

Istio VirtualService delegate with mesh gateway

1 Answers