Kong Ingress controller is unable to route request to Istio virtual services

We’re running Istio service mesh on Kubernetes and Kong as API gateway and ingress controller for our K8S cluster.
We’ve created virtual services and destination rules for our micro-services and communications between our micro-services are working as expected except Kong is sending traffic directly to Upstream server instead of applying the virtual service and destination rules.
Scenario
We have a micro-service deployed with 3 different versions and we have created virtual service to send traffic to only version v1 and v3. This is working fine when the micro-services communicate internally. But whenever we hit it through kong, the traffic is getting distributed evenly ( like it does without any traffic rule).
Also, kong ingress LB is showing as unknown node and I’m assuming it because the LB is outside the Istio mesh. Is it possible to use Kong instead of istio ingress gateway or am I missing something here.

Can you explain how you have deployed Kong with Istio?
Is Kong itself part of the Istio Mesh or not?

The following blog goes into a little bit of detail on how Kong can be integrated with Istio:
https://konghq.com/blog/kong-istio-setting-service-mesh-kubernetes-kiali-observability/

Also, please make sure that you have got the Envoy side-car running alongside Kong.

We’re using Kong as API gateway and ingress controller. We’ve installed it using helm. The Envoy sidecar container is also running along with kong container and we can see the routes using istioctl.
The bookinfo application is also working fine with our Kong + istio setup.

All traffic rules for all the bookinfo services are working as expected, except productpage as kong is hitting it directly. For the rest of the services, productpage service is hitting them and productpage is part of istio mesh. (Since the sidecar is also running with Kong, it should also be a part istio mesh, but it doesn’t seem to route according to rules in VirtualService and DestinationRules)

@kevin.chen Have you tried running multiple versions of productpage service (say v1 and v2) and then set some traffic rules in its Virtualservice? I believe kong would evenly distribute the traffic irrespective of traffic distribution rules defined in your Virtualservice.

FYI, the traffic rule doesn’t apply only if it’s coming from kong. The inter-communication between other micro-services is working as expected.
Please let me know if you need more details here.

Can you share the Ingress rule that you have created?

We are working on a blogpost and documentation on how to configure this.

You will have to set the following annotation on the productpage service:

After adding the annotation on the service, kong stopped load-balancing. But istio VirtualService rules are still not in effect. Even if we delete the Istio VirtaulService, it keeps sending the traffic on 1 version only.

apiVersion: extensions/v1beta1
kind: Ingress
metadata:
annotations:
configuration.konghq.com: kong-ingress-config
kubernetes.io/ingress.class: kong
name: kong-ingress-sms-notification-service
namespace: hyke-stage
spec:
rules:
-host: stage-pvt.hykeapi.com
http:
paths:
- backend:
serviceName: sms-notification-service
servicePort: 8080
path: /sms-notification-service

apiVersion: v1
kind: Service
metadata:
annotations:
ingress.kubernetes.io/service-upstream: “true”
labels:
chart: java-gradle-0.25
name: sms-notification-service
namespace: hyke-stage
spec:
ports:
-name: http
port: 80
protocol: TCP
targetPort: 8080
selector:
app: sms-notification-service
sessionAffinity: None
type: ClusterIP

We’re running 3 different versions behind sms-notification-service and we can see all 3 endpoints when we describe service. But for some reason, all the traffic is getting routed to only one version after adding the annotation.

Is there any update on this?

After adding the annotation on service, the upstream target has the Kubernetes service name as expected (PFA screenshot). But the load balancing is still not working as expected. kong-upstream
How to adjust upstream slots value using KongIgress?

Do you have a routing policy in Istio for Kong to send traffic only to a specific version of the virtual service?

Please share more configuration on the Istio side as to how you have set this up.
Thanks!


© 2019 Kong Inc.    Terms  •  Privacy  •  FAQ