Answers: <p>I encountered the same error but with a different issue. The Service port needed a name added to it. <a href="https://github.com/istio/istio/issues/19966" rel="noreferrer">https://github.com/istio/istio/issues/19966</a>. And they need to follow the format (protocol-suffix) <a href="https://istio.io/docs/ops/deployment/requirements/" rel="noreferrer">https://istio.io/docs/ops/deployment/requirements/</a></p>
  
  <pre><code>ports:
      - name: https # Use http or https
         protocol: TCP
         port: 8080
         targetPort: 8080
  </code></pre>
  
Answers: CC BY-SA 4.0
Answers: 2020-02-28T22:09:28.563Z
Answers: 2020-03-02T16:43:04.390Z
Answers: 2020-03-02T16:43:04.390Z
Answers: leo
Answers: <p>This is most probably there is mismatch of the port that application running in the DOCKER is not the same port exposed in the DOCKER configuration</p>
  <p>Docker file <code>EXPOSE &lt;PORT&gt;</code> should be same as the port the application is started.</p>
  <p>Istio Ingress gateway can bind to the container port but can't communicate the application.</p>
  
Answers: CC BY-SA 4.0
Answers: 2020-08-06T14:10:04.180Z
Answers: 2020-08-06T14:10:04.180Z
Answers: Anand
Answers: <p>I have resolved the issue by update the gateway manifest.
  Not sure why the error happen when adding multiple "match".</p>
  
  <pre><code>apiVersion: networking.istio.io/v1alpha3
  kind: Gateway
  metadata:
    name: istio-gateway
  spec:
    selector:
      istio: ingressgateway #default istio ingressgateway
    servers:
    - port:
        number: 80
        name: http-istio-gateway
        protocol: HTTP
      hosts:
      - "*"
      tls:
        httpsRedirect: true
    - port:
        number: 443
        name: https-istio-gateway
        protocol: HTTP
      hosts:
      - "*"
  ---
  apiVersion: networking.istio.io/v1alpha3
  kind: VirtualService
  metadata:
    name: api-gateway
  spec:
    gateways:
    - istio-gateway
    hosts:
    - "*"
    http:
    - match:
      - uri:
          prefix: "/socket.io"
      route:
      - destination:
          host: api-gateway-ws.default.svc.cluster.local
          port:
            number: 5001
      websocketUpgrade: true
    - route:
      - destination:
          host: api-gateway.default.svc.cluster.local
          port:
            number: 5000
  </code></pre>
  
Answers: CC BY-SA 4.0
Answers: 2019-05-21T04:01:37.233Z
Answers: 2019-05-21T04:01:37.233Z
Answers: pcuong
Answers: <p><strong>Split large virtual services and destination rules into multiple resources:</strong> The downside of your kind of configuration is that other configuration (e.g., route rules) for any of the underlying microservices, will need to also be included in this single configuration file.
  Reference: <a href="https://istio.io/docs/ops/best-practices/traffic-management/" rel="nofollow noreferrer">https://istio.io/docs/ops/best-practices/traffic-management/</a><a href="https://istio.io/docs/ops/best-practices/traffic-management/" rel="nofollow noreferrer">enter link description here</a></p>
  
Answers: CC BY-SA 4.0
Answers: 2020-06-09T17:09:48.880Z
Answers: 2020-06-09T17:09:48.880Z
Answers: Rishabh Jain
Answers: <p>sometimes it happens when you apply Istio mTLS so first try to disable mTLS in the relevant namespace. (especially if you are using some kind of gRPC in the pod)</p>
  <pre><code>kubectl get peerauthentication --all-namespaces
  
  </code></pre>
  
Answers: CC BY-SA 4.0
Answers: 2020-08-20T08:12:45.890Z
Answers: 2020-08-20T11:37:43.123Z
Answers: 2020-08-20T11:37:43.123Z
Answers: user23625
Body: <p>I try to setup an aws load balancer (ELB) with SSL follow the instruction at <a href="https://github.com/istio/istio/issues/6566" rel="noreferrer">#6566</a></p>
  
  <p>Certificate was attached on ELB.</p>
  
  <p>However, I got the issue "<strong>upstream connect error or disconnect/reset before headers. reset reason: connection termination</strong>" when trying to access our web on browser.</p>
  
  <p>Our setup without SSL has been worked before.</p>
  
  <p>I use the custom values.yaml to install the istio (helm template):</p>
  
  <pre><code>helm template ./istio/install/kubernetes/helm/istio --name istio \
  --namespace istio-system --values ./mesh/values.yaml | kubectl apply -f -
  </code></pre>
  
  <p>I have inserted below annotations to the <code>gateways</code> tag:</p>
  
  <pre><code>istio-ingressgateway:
      serviceAnnotations: 
        service.beta.kubernetes.io/aws-load-balancer-ssl-cert: "arn:aws:acm:ap-southeast-1:xxxxx:certificate/my-crt"
        service.beta.kubernetes.io/aws-load-balancer-backend-protocol: "http"
        service.beta.kubernetes.io/aws-load-balancer-ssl-ports: "https"
  </code></pre>
  
  <p>Here is my <code>gateway.yaml</code>:</p>
  
  <pre><code>apiVersion: networking.istio.io/v1alpha3
  kind: Gateway
  metadata:
    name: istio-gateway
  spec:
    selector:
      istio: ingressgateway #default istio ingressgateway
    servers:
    - port:
        number: 80
        name: http-istio-gateway
        protocol: HTTP
      hosts:
      - "*"
      tls:
        httpsRedirect: true
    - port:
        number: 443
        name: https-istio-gateway
        protocol: HTTP
      hosts:
      - "*"
  ---
  apiVersion: networking.istio.io/v1alpha3
  kind: VirtualService
  metadata:
    name: api-gateway
  spec:
    gateways:
    - istio-gateway
    hosts:
    - "*"
    http:
    - match:
      - uri:
          prefix: /socket.io/
      route:
      - destination:
          host: api-gateway-ws.default.svc.cluster.local
          port:
            number: 5001
    - match:
      - uri:
          prefix: /
      route:
      - destination:
          host: api-gateway.default.svc.cluster.local
          port:
            number: 5000
  </code></pre>
  
Comments: CC BY-SA 4.0
Comments: 2019-05-20T22:34:27.977Z
Comments: What does the log indicate?
Comments: 030
Comments: CC BY-SA 4.0
Comments: 2019-05-25T19:28:08.613Z
Comments: @030: I think there is a problem with sync data between pilot and istio-proxy.
  The first time I start my services, I unable to login. However, If I delete all services and start its again, it worked !
Comments: pcuong
Tags: <kubernetes><istio>
Title: How to solve 'upstream connect error or disconnect/reset before headers. reset reason: connection termination' in Istio?
UserDisplayName: pcuong
ThreadText: # How to solve 'upstream connect error or disconnect/reset before headers. reset reason: connection termination' in Istio?
  
  (Asked by: username_0 on 2019-05-19)
  
  I try to setup an aws load balancer (ELB) with SSL follow the instruction at [#6566](https://github.com/istio/istio/issues/6566)
  
  Certificate was attached on ELB.
  
  However, I got the issue "**upstream connect error or disconnect/reset before headers. reset reason: connection termination**" when trying to access our web on browser.
  
  Our setup without SSL has been worked before.
  
  I use the custom values.yaml to install the istio (helm template):
  
  ```
  helm template ./istio/install/kubernetes/helm/istio --name istio \
  --namespace istio-system --values ./mesh/values.yaml | kubectl apply -f -
  
  ```
  
  I have inserted below annotations to the `gateways` tag:
  
  ```
  istio-ingressgateway:
      serviceAnnotations: 
        service.beta.kubernetes.io/aws-load-balancer-ssl-cert: "arn:aws:acm:ap-southeast-1:xxxxx:certificate/my-crt"
        service.beta.kubernetes.io/aws-load-balancer-backend-protocol: "http"
        service.beta.kubernetes.io/aws-load-balancer-ssl-ports: "https"
  
  ```
  
  Here is my `gateway.yaml`:
  
  ```
  apiVersion: networking.istio.io/v1alpha3
  kind: Gateway
  metadata:
    name: istio-gateway
  spec:
    selector:
      istio: ingressgateway #default istio ingressgateway
    servers:
    - port:
        number: 80
        name: http-istio-gateway
        protocol: HTTP
      hosts:
      - "*"
      tls:
        httpsRedirect: true
    - port:
        number: 443
        name: https-istio-gateway
        protocol: HTTP
      hosts:
      - "*"
  ---
  apiVersion: networking.istio.io/v1alpha3
  kind: VirtualService
  metadata:
    name: api-gateway
  spec:
    gateways:
    - istio-gateway
    hosts:
    - "*"
    http:
    - match:
      - uri:
          prefix: /socket.io/
      route:
      - destination:
          host: api-gateway-ws.default.svc.cluster.local
          port:
            number: 5001
    - match:
      - uri:
          prefix: /
      route:
      - destination:
          host: api-gateway.default.svc.cluster.local
          port:
            number: 5000
  
  ```
  
  **Tags:** kubernetes, istio
  
  > **Comments:**
  > **username_1**: What does the log indicate?  
  > **username_0**: @username_1: I think there is a problem with sync data between pilot and istio-proxy. The first time I start my services, I unable to login. However, If I delete all services and start its again, it worked !  
  
  ---
  
  ## 5 answers
  
  ### Answer by username_2 on 2020-02-28. Score: 7
  
  I encountered the same error but with a different issue. The Service port needed a name added to it. <https://github.com/istio/istio/issues/19966>. And they need to follow the format (protocol-suffix) <https://istio.io/docs/ops/deployment/requirements/>
  
  ```
  ports:
      - name: https # Use http or https
         protocol: TCP
         port: 8080
         targetPort: 8080
  
  ```
  
  
  ---
  
  ### Answer by username_3 on 2020-08-06. Score: 4
  
  This is most probably there is mismatch of the port that application running in the DOCKER is not the same port exposed in the DOCKER configuration
  
  Docker file `EXPOSE <PORT>` should be same as the port the application is started.
  
  Istio Ingress gateway can bind to the container port but can't communicate the application.
  
  
  ---
  
  ### Answer by username_0 on 2019-05-21. Score: 4
  
  I have resolved the issue by update the gateway manifest.
  Not sure why the error happen when adding multiple "match".
  
  ```
  apiVersion: networking.istio.io/v1alpha3
  kind: Gateway
  metadata:
    name: istio-gateway
  spec:
    selector:
      istio: ingressgateway #default istio ingressgateway
    servers:
    - port:
        number: 80
        name: http-istio-gateway
        protocol: HTTP
      hosts:
      - "*"
      tls:
        httpsRedirect: true
    - port:
        number: 443
        name: https-istio-gateway
        protocol: HTTP
      hosts:
      - "*"
  ---
  apiVersion: networking.istio.io/v1alpha3
  kind: VirtualService
  metadata:
    name: api-gateway
  spec:
    gateways:
    - istio-gateway
    hosts:
    - "*"
    http:
    - match:
      - uri:
          prefix: "/socket.io"
      route:
      - destination:
          host: api-gateway-ws.default.svc.cluster.local
          port:
            number: 5001
      websocketUpgrade: true
    - route:
      - destination:
          host: api-gateway.default.svc.cluster.local
          port:
            number: 5000
  
  ```
  
  
  ---
  
  ### Answer by username_4 on 2020-06-09. Score: 1
  
  **Split large virtual services and destination rules into multiple resources:** The downside of your kind of configuration is that other configuration (e.g., route rules) for any of the underlying microservices, will need to also be included in this single configuration file.
  Reference: <https://istio.io/docs/ops/best-practices/traffic-management/>[enter link description here](https://istio.io/docs/ops/best-practices/traffic-management/)
  
  
  ---
  
  ### Answer by username_5 on 2020-08-20. Score: 0
  
  sometimes it happens when you apply Istio mTLS so first try to disable mTLS in the relevant namespace. (especially if you are using some kind of gRPC in the pod)
  
  ```
  kubectl get peerauthentication --all-namespaces
  
  ```
  
  
  ---
  
  