NAME READY STATUS RESTARTS AGE catalog-v1-5bf8c759b9-pcphd 2/2 Running 0 1h catalog-v2-547b5f6769-7sdkd 2/2 Running 0 1h catalog-v3-569bd6c7d9-sgz8h 2/2 Running 0 1h product-v1-747cf9f795-z5ps2 2/2 Running 0 1h sleep-64cbb8bf78-2w85v 2/2 Running 0 1h user-v1-6b5c74b477-svtj7 2/2 Running 0 1h root@scamp1:~# kubectl exec -it user-v1-6b5c74b477-svtj7 -- curl 10.0.0.31:8000 Defaulting container name to user. upstream connect error or disconnect/reset before headers 

To configure the client side, you need to set destination rules to use mutual TLS. It is possible to use multiple destination rules, one for each applicable service (or namespace). However, it is more convenient to use a rule with the * wildcard to match all services so that the configuration is on par with the mesh-wide authentication policy. See Example 9-41. 

r oot@scamp1:~# cat <<EOF | kubectl apply -f - > apiVersion: "networking.istio.io/v1alpha3" > kind: "DestinationRule" > metadata: > name: "default" > namespace: "default" > spec: > host: "*.local" > trafficPolicy: > tls: > mode: ISTIO_MUTUAL > EOF destinationrule.networking.istio.io/default created 

Now, try to make a call to the catalog microservice from the user microservice. See Example 9-42. 

root@scamp1:~# kubectl exec -it user-v1-6b5c74b477-svtj7 -- curl 10.0.0.31:8000 Defaulting container name to user. user==>catalog:v2==>product::Able to fetch infromation from product service 

