What's Actually Happening

Istio is not routing traffic as expected. Requests don't reach the correct services or follow defined routing rules.

The Error You'll See

  • Traffic not reaching canary version
  • 404 errors from Istio proxy
  • Wrong service receiving traffic

Why This Happens

  1. 1.VirtualService misconfiguration
  2. 2.DestinationRule issues
  3. 3.Gateway not configured
  4. 4.Subset labels mismatch
  5. 5.Sidecar not injected

Step 1: Check VirtualService

bash
kubectl get virtualservice -n myapp
kubectl describe virtualservice myapp-vs -n myapp

Step 2: Check DestinationRule

bash
kubectl get destinationrule -n myapp
kubectl describe destinationrule myapp-dr -n myapp

Step 3: Check Gateway

bash
kubectl get gateway -n myapp
kubectl describe gateway myapp-gateway -n myapp

Step 4: Verify Service Labels

bash
kubectl get pods -n myapp --show-labels
# Labels must match DestinationRule subset

Step 5: Check Sidecar Injection

bash
kubectl get pods -n myapp -o jsonpath='{.items[*].spec.containers[*].name}' | grep istio-proxy
kubectl get namespace myapp --show-labels
# Should have istio-injection=enabled

Step 6: Check Istiod Logs

bash
kubectl logs -n istio-system deployment/istiod

Step 7: Check Envoy Config

bash
istioctl proxy-config cluster deployment/myapp -n myapp
istioctl proxy-config route deployment/myapp -n myapp

Step 8: Analyze Configuration

bash
istioctl analyze -n myapp

Step 9: Check Service Entry

bash
kubectl get serviceentry -n myapp

Step 10: Test Routing

bash
curl -H "Host: myapp.example.com" http://istio-gateway/
  • [Fix Istio Proxy Sidecar Not Ready](/articles/fix-istio-proxy-sidecar-not-ready)
  • [Fix Linkerd Proxy Sidecar Not Injecting](/articles/fix-linkerd-proxy-sidecar-not-injecting)