payload: {"action":"created","issue":{"url":"https://api.github.com/repos/istio/istio/issues/14736","repository_url":"https://api.github.com/repos/istio/istio","labels_url":"https://api.github.com/repos/istio/istio/issues/14736/labels{/name}","comments_url":"https://api.github.com/repos/istio/istio/issues/14736/comments","events_url":"https://api.github.com/repos/istio/istio/issues/14736/events","html_url":"https://github.com/istio/istio/issues/14736","id":455087323,"node_id":"MDU6SXNzdWU0NTUwODczMjM=","number":14736,"title":"Egress Gateways - Apply Kubernetes network policies failure","user":{"login":"jkbschmid","id":44965368,"node_id":"MDQ6VXNlcjQ0OTY1MzY4","avatar_url":"https://avatars0.githubusercontent.com/u/44965368?v=4","gravatar_id":"","url":"https://api.github.com/users/jkbschmid","html_url":"https://github.com/jkbschmid","followers_url":"https://api.github.com/users/jkbschmid/followers","following_url":"https://api.github.com/users/jkbschmid/following{/other_user}","gists_url":"https://api.github.com/users/jkbschmid/gists{/gist_id}","starred_url":"https://api.github.com/users/jkbschmid/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jkbschmid/subscriptions","organizations_url":"https://api.github.com/users/jkbschmid/orgs","repos_url":"https://api.github.com/users/jkbschmid/repos","events_url":"https://api.github.com/users/jkbschmid/events{/privacy}","received_events_url":"https://api.github.com/users/jkbschmid/received_events","type":"User","site_admin":false},"labels":[{"id":735781806,"node_id":"MDU6TGFiZWw3MzU3ODE4MDY=","url":"https://api.github.com/repos/istio/istio/labels/area/networking","name":"area/networking","color":"0e8a16","default":false},{"id":572371847,"node_id":"MDU6TGFiZWw1NzIzNzE4NDc=","url":"https://api.github.com/repos/istio/istio/labels/kind/docs","name":"kind/docs","color":"fbca04","default":false}],"state":"open","locked":false,"assignee":{"login":"rlenglet","id":126329,"node_id":"MDQ6VXNlcjEyNjMyOQ==","avatar_url":"https://avatars3.githubusercontent.com/u/126329?v=4","gravatar_id":"","url":"https://api.github.com/users/rlenglet","html_url":"https://github.com/rlenglet","followers_url":"https://api.github.com/users/rlenglet/followers","following_url":"https://api.github.com/users/rlenglet/following{/other_user}","gists_url":"https://api.github.com/users/rlenglet/gists{/gist_id}","starred_url":"https://api.github.com/users/rlenglet/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rlenglet/subscriptions","organizations_url":"https://api.github.com/users/rlenglet/orgs","repos_url":"https://api.github.com/users/rlenglet/repos","events_url":"https://api.github.com/users/rlenglet/events{/privacy}","received_events_url":"https://api.github.com/users/rlenglet/received_events","type":"User","site_admin":false},"assignees":[{"login":"rlenglet","id":126329,"node_id":"MDQ6VXNlcjEyNjMyOQ==","avatar_url":"https://avatars3.githubusercontent.com/u/126329?v=4","gravatar_id":"","url":"https://api.github.com/users/rlenglet","html_url":"https://github.com/rlenglet","followers_url":"https://api.github.com/users/rlenglet/followers","following_url":"https://api.github.com/users/rlenglet/following{/other_user}","gists_url":"https://api.github.com/users/rlenglet/gists{/gist_id}","starred_url":"https://api.github.com/users/rlenglet/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rlenglet/subscriptions","organizations_url":"https://api.github.com/users/rlenglet/orgs","repos_url":"https://api.github.com/users/rlenglet/repos","events_url":"https://api.github.com/users/rlenglet/events{/privacy}","received_events_url":"https://api.github.com/users/rlenglet/received_events","type":"User","site_admin":false}],"milestone":{"url":"https://api.github.com/repos/istio/istio/milestones/15","html_url":"https://github.com/istio/istio/milestone/15","labels_url":"https://api.github.com/repos/istio/istio/milestones/15/labels","id":4277733,"node_id":"MDk6TWlsZXN0b25lNDI3NzczMw==","number":15,"title":"1.2","description":"","creator":{"login":"fpesce","id":4336228,"node_id":"MDQ6VXNlcjQzMzYyMjg=","avatar_url":"https://avatars3.githubusercontent.com/u/4336228?v=4","gravatar_id":"","url":"https://api.github.com/users/fpesce","html_url":"https://github.com/fpesce","followers_url":"https://api.github.com/users/fpesce/followers","following_url":"https://api.github.com/users/fpesce/following{/other_user}","gists_url":"https://api.github.com/users/fpesce/gists{/gist_id}","starred_url":"https://api.github.com/users/fpesce/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/fpesce/subscriptions","organizations_url":"https://api.github.com/users/fpesce/orgs","repos_url":"https://api.github.com/users/fpesce/repos","events_url":"https://api.github.com/users/fpesce/events{/privacy}","received_events_url":"https://api.github.com/users/fpesce/received_events","type":"User","site_admin":false},"open_issues":118,"closed_issues":167,"state":"open","created_at":"2019-05-01T18:34:52Z","updated_at":"2019-06-14T22:50:35Z","due_on":"2019-06-19T07:00:00Z","closed_at":null},"comments":18,"created_at":"2019-06-12T08:49:15Z","updated_at":"2019-06-15T00:03:51Z","closed_at":null,"author_association":"CONTRIBUTOR","body":"**Bug description**\r\n\r\nThe scenario described in [Apply Kubernetes network policies](https://preliminary.istio.io/docs/tasks/traffic-management/egress/egress-gateway/#apply-kubernetes-network-policies) cannot be successfully followed.\r\n\r\nStep 9: \r\n```\r\n$ kubectl exec -it $(kubectl get pod -n test-egress -l app=sleep -o jsonpath={.items..metadata.name}) -n test-egress -c sleep -- curl -v https://edition.cnn.com/politics\r\n* Could not resolve host: edition.cnn.com\r\n* Closing connection 0\r\ncurl: (6) Could not resolve host: edition.cnn.com\r\ncommand terminated with exit code 6\r\n```\r\nshows a different error message. Probably not relevant, since hostname can't be resolved as well.\r\n\r\nStep 13 (curling cnn via egress) fails:\r\n```\r\n$ kubectl exec -it $(kubectl get pod -n test-egress -l app=sleep -o jsonpath={.items..metadata.name}) -n test-egress -c sleep -- curl -s -o /dev/null -w \"%{http_code}\\n\" https://edition.cnn.com/politics\r\n000\r\ncommand terminated with exit code 6\r\n```\r\nEnvoy's readiness probe fails:\r\n```\r\n$ kubectl get pods -n test-egress\r\nNAME                     READY   STATUS    RESTARTS   AGE\r\nsleep-5fb55468cb-68hg9   1/2     Running   0          14s\r\n```\r\nEnvoy logs show the following:\r\n```\r\n[2019-06-12 08:30:45.574][16][warning][config] [bazel-out/k8-opt/bin/external/envoy/source/common/config/_virtual_includes/grpc_stream_lib/common/config/grpc_stream.h:86] gRPC config stream closed: 14, no healthy upstream\r\n[2019-06-12 08:30:45.574][16][warning][config] [bazel-out/k8-opt/bin/external/envoy/source/common/config/_virtual_includes/grpc_stream_lib/common/config/grpc_stream.h:49] Unable to establish new stream\r\n[2019-06-12 08:30:45.953][16][warning][config] [bazel-out/k8-opt/bin/external/envoy/source/common/config/_virtual_includes/grpc_stream_lib/common/config/grpc_stream.h:86] gRPC config stream closed: 14, no healthy upstream\r\n[2019-06-12 08:30:45.953][16][warning][config] [bazel-out/k8-opt/bin/external/envoy/source/common/config/_virtual_includes/grpc_stream_lib/common/config/grpc_stream.h:49] Unable to establish new stream\r\n2019-06-12T08:30:46.270973Z     info    Envoy proxy is NOT ready: config not received from Pilot (is Pilot running?): cds updates: 0 successful, 0 rejected; lds updates: 0 successful, 0 rejected\r\n2019-06-12T08:30:48.271003Z     info    Envoy proxy is NOT ready: config not received from Pilot (is Pilot running?): cds updates: 0 successful, 0 rejected; lds updates: 0 successful, 0 rejected\r\n[2019-06-12 08:30:49.570][16][warning][config] [bazel-out/k8-opt/bin/external/envoy/source/common/config/_virtual_includes/grpc_stream_lib/common/config/grpc_stream.h:86] gRPC config stream closed: 14, no healthy upstream\r\n[2019-06-12 08:30:49.570][16][warning][config] [bazel-out/k8-opt/bin/external/envoy/source/common/config/_virtual_includes/grpc_stream_lib/common/config/grpc_stream.h:49] Unable to establish new stream\r\n2019-06-12T08:30:50.270592Z     info    Envoy proxy is NOT ready: config not received from Pilot (is Pilot running?): cds updates: 0 successful, 0 rejected; lds updates: 0 successful, 0 rejected\r\n```\r\n\r\n\r\n**Affected product area (please put an X in all that apply)**\r\n\r\n[ ] Configuration Infrastructure\r\n[ ] Docs\r\n[ ] Installation\r\n[ ] Networking\r\n[ ] Performance and Scalability\r\n[X] Policies and Telemetry\r\n[ ] Security\r\n[ ] Test and Release\r\n[ ] User Experience\r\n\r\n**Expected behavior**\r\nCurl should succeed.\r\n\r\n**Version (include the output of `istioctl version --remote` and `kubectl version`)**\r\nIstio: 1.2.0-rc.0\r\nKubectl: \r\n```\r\nClient Version: version.Info{Major:\"1\", Minor:\"14\", GitVersion:\"v1.14.3\", GitCommit:\"5e53fd6bc17c0dec8434817e69b04a25d8ae0ff0\", GitTreeState:\"clean\", BuildDate:\"2019-06-07T09:55:27Z\", GoVersion:\"go1.12.5\", Compiler:\"gc\", Platform:\"darwin/amd64\"}\r\nServer Version: version.Info{Major:\"1\", Minor:\"14\", GitVersion:\"v1.14.0\", GitCommit:\"641856db18352033a0d96dbc99153fa3b27298e5\", GitTreeState:\"clean\", BuildDate:\"2019-03-25T15:45:25Z\", GoVersion:\"go1.12.1\", Compiler:\"gc\", Platform:\"linux/amd64\"}\r\n```\r\n**How was Istio installed?**\r\nInstalled via [installation guide]\r\n(https://preliminary.istio.io/docs/setup/kubernetes/install/kubernetes/).\r\nNote: For the demo to have an effect, I set passthrough mode to `REGISTRY_ONLY` via:\r\n```\r\nkubectl get configmap istio -n istio-system -o yaml | sed 's/mode: REGISTRY_ONLY/mode: ALLOW_ANY/g' | kubectl replace -n istio-system -f -\r\n```\r\n**Environment where bug was observed (cloud vendor, OS, etc)**\r\nGKE.\r\n\r\n"},"comment":{"url":"https://api.github.com/repos/istio/istio/issues/comments/502315035","html_url":"https://github.com/istio/istio/issues/14736#issuecomment-502315035","issue_url":"https://api.github.com/repos/istio/istio/issues/14736","id":502315035,"node_id":"MDEyOklzc3VlQ29tbWVudDUwMjMxNTAzNQ==","user":{"login":"rlenglet","id":126329,"node_id":"MDQ6VXNlcjEyNjMyOQ==","avatar_url":"https://avatars3.githubusercontent.com/u/126329?v=4","gravatar_id":"","url":"https://api.github.com/users/rlenglet","html_url":"https://github.com/rlenglet","followers_url":"https://api.github.com/users/rlenglet/followers","following_url":"https://api.github.com/users/rlenglet/following{/other_user}","gists_url":"https://api.github.com/users/rlenglet/gists{/gist_id}","starred_url":"https://api.github.com/users/rlenglet/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rlenglet/subscriptions","organizations_url":"https://api.github.com/users/rlenglet/orgs","repos_url":"https://api.github.com/users/rlenglet/repos","events_url":"https://api.github.com/users/rlenglet/events{/privacy}","received_events_url":"https://api.github.com/users/rlenglet/received_events","type":"User","site_admin":false},"created_at":"2019-06-15T00:03:51Z","updated_at":"2019-06-15T00:03:51Z","author_association":"MEMBER","body":"The `sleep` pods in the `default` and the `test-egress` namespaces have exactly the same listener configurations for the `edition.cnn.com` virtual host."}}
other: {"actor":{"display_login":"rlenglet"}}