The stock-rest-app sample can't access stock quotes web service

[trisberg]

/area build
/area networking
/kind bug
/kind doc

Expected Behavior

I build and deploy the sample app and when accessing the app I can get stock prices for specified ticker.

Actual Behavior

$ curl --header "Host:$SERVICE_HOST" http://${SERVICE_IP}
Welcome to the stock app! 
$ curl --header "Host:$SERVICE_HOST" http://${SERVICE_IP}/stock/GOOG
stock not found for ticker : GOOG 

Steps to Reproduce the Problem

1. Follow the instruction for the stock-rest-app sample
2. curl the sample app's endpoint with a ticker
3. the ticker is not found message should show

Additional Info

Looks like an issue with Istio egress configuration - not sure if this is something the developer has to configure, but if the developer is expected to do this then that should be added to the sample.

I played around with a few different egress rules and this one seemed to work:

apiVersion: config.istio.io/v1alpha2
kind: EgressRule
metadata:
  name: stock-rest-app-egress-tcp
spec:
  destination:
      service: 35.225.233.74/32
  ports:
      - port: 443
        protocol: tcp

I now get:

$ curl --header "Host:$SERVICE_HOST" http://${SERVICE_IP}/stock/GOOG
stock price for ticker GOOG is 1097.86

[mattmoor]

This is the service mesh blocking outbound connections. @mdemirhan What's our plan here?

[mattmoor]

FWIW we have a similar problem in steren-app talking the GCE metadata for auth.

[mdemirhan]

I was looking into this today. The calls are blocked by design and all egress need to be specified using EgressRule files. Rule file above works but it is not really the right thing to do as it relies on IP addresses rather than domain names. The rule we want is something like below:

apiVersion: config.istio.io/v1alpha2
kind: EgressRule
metadata:
  name: google-egress-rule
spec:
  destination:
    service: www.google.com
  ports:
    - port: 443
      protocol: https

But there are some bugs in Istio with https + domain names. It doesn't work today. I will try this with pre-release 0.8.0 Istio and report back here. If the pre-release fails as well, we will need to work with Istio team.

[trisberg]

OK, good to know it's not just me. I tried the https rule using "api.iextrading.com" but couldn't get that to work.

[evankanderson]

It looks like this was addressed by #1065 ?

@mdemirhan @will-cromar can you verify?

[will-cromar]

I still encountered this problem on a fresh Knative installation today. For now, I've worked around this problem using a ServiceEntry, as documented here.

It looks something like what @mdemirhan was describing:

apiVersion: networking.istio.io/v1alpha3
kind: ServiceEntry
metadata:
  name: external-services
spec:
  hosts:
  - 169.254.169.254 # GCE metadata server, for example
  - api.iextrading.com
  ports:
  - number: 80
    protocol: HTTP
  - number: 443
    protocol: HTTPS

Am I correct to assume that the end goal is that users won't have to manually declare external services?

[mdemirhan]

This will be addressed by #1123. Users won't need to add Egress rules or ServiceEntries.

[mdemirhan]

@trisberg and @will-cromar - Can you please test this with the latest master by limiting istio injection only to the cluster?

Updated instructions are at: https://github.com/knative/serving/blob/master/DEVELOPMENT.md#deploy-knative-serving

After getting latest master, edit config-network.yaml with the instructions in the file. Then apply config file and controller changes using ko apply -f config/. Any new revisions from this point on should work correctly without needing ServiceEntry or Egress rules.

I will close this issue once I get the confirmation from you that it is working.

[trisberg]

@mdemirhan I can confirm that it worked for me using GKE.

[will-cromar]

@mdemirhan I can also confirm that it worked on GKE.