<p>I encountered the same error but with a different issue. The Service port needed a name added to it. <a href="https://github.com/istio/istio/issues/19966" rel="noreferrer">https://github.com/istio/istio/issues/19966</a>. And they need to follow the format (protocol-suffix) <a href="https://istio.io/docs/ops/deployment/requirements/" rel="noreferrer">https://istio.io/docs/ops/deployment/requirements/</a></p>

<pre><code>ports:
    - name: https # Use http or https
       protocol: TCP
       port: 8080
       targetPort: 8080
</code></pre>

CC BY-SA 4.0
2020-02-28T22:09:28.563Z
2020-03-02T16:43:04.390Z
2020-03-02T16:43:04.390Z
leo
<p>This is most probably there is mismatch of the port that application running in the DOCKER is not the same port exposed in the DOCKER configuration</p>
<p>Docker file <code>EXPOSE &lt;PORT&gt;</code> should be same as the port the application is started.</p>
<p>Istio Ingress gateway can bind to the container port but can't communicate the application.</p>

CC BY-SA 4.0
2020-08-06T14:10:04.180Z
2020-08-06T14:10:04.180Z
Anand
<p>I have resolved the issue by update the gateway manifest.
Not sure why the error happen when adding multiple "match".</p>

<pre><code>apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: istio-gateway
spec:
  selector:
    istio: ingressgateway #default istio ingressgateway
  servers:
  - port:
      number: 80
      name: http-istio-gateway
      protocol: HTTP
    hosts:
    - "*"
    tls:
      httpsRedirect: true
  - port:
      number: 443
      name: https-istio-gateway
      protocol: HTTP
    hosts:
    - "*"
---
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: api-gateway
spec:
  gateways:
  - istio-gateway
  hosts:
  - "*"
  http:
  - match:
    - uri:
        prefix: "/socket.io"
    route:
    - destination:
        host: api-gateway-ws.default.svc.cluster.local
        port:
          number: 5001
    websocketUpgrade: true
  - route:
    - destination:
        host: api-gateway.default.svc.cluster.local
        port:
          number: 5000
</code></pre>

CC BY-SA 4.0
2019-05-21T04:01:37.233Z
2019-05-21T04:01:37.233Z
pcuong
<p><strong>Split large virtual services and destination rules into multiple resources:</strong> The downside of your kind of configuration is that other configuration (e.g., route rules) for any of the underlying microservices, will need to also be included in this single configuration file.
Reference: <a href="https://istio.io/docs/ops/best-practices/traffic-management/" rel="nofollow noreferrer">https://istio.io/docs/ops/best-practices/traffic-management/</a><a href="https://istio.io/docs/ops/best-practices/traffic-management/" rel="nofollow noreferrer">enter link description here</a></p>

CC BY-SA 4.0
2020-06-09T17:09:48.880Z
2020-06-09T17:09:48.880Z
Rishabh Jain
<p>sometimes it happens when you apply Istio mTLS so first try to disable mTLS in the relevant namespace. (especially if you are using some kind of gRPC in the pod)</p>
<pre><code>kubectl get peerauthentication --all-namespaces

</code></pre>

CC BY-SA 4.0
2020-08-20T08:12:45.890Z
2020-08-20T11:37:43.123Z
2020-08-20T11:37:43.123Z
user23625
<p>I try to setup an aws load balancer (ELB) with SSL follow the instruction at <a href="https://github.com/istio/istio/issues/6566" rel="noreferrer">#6566</a></p>

<p>Certificate was attached on ELB.</p>

<p>However, I got the issue "<strong>upstream connect error or disconnect/reset before headers. reset reason: connection termination</strong>" when trying to access our web on browser.</p>

<p>Our setup without SSL has been worked before.</p>

<p>I use the custom values.yaml to install the istio (helm template):</p>

<pre><code>helm template ./istio/install/kubernetes/helm/istio --name istio \
--namespace istio-system --values ./mesh/values.yaml | kubectl apply -f -
</code></pre>

<p>I have inserted below annotations to the <code>gateways</code> tag:</p>

<pre><code>istio-ingressgateway:
    serviceAnnotations: 
      service.beta.kubernetes.io/aws-load-balancer-ssl-cert: "arn:aws:acm:ap-southeast-1:xxxxx:certificate/my-crt"
      service.beta.kubernetes.io/aws-load-balancer-backend-protocol: "http"
      service.beta.kubernetes.io/aws-load-balancer-ssl-ports: "https"
</code></pre>

<p>Here is my <code>gateway.yaml</code>:</p>

<pre><code>apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: istio-gateway
spec:
  selector:
    istio: ingressgateway #default istio ingressgateway
  servers:
  - port:
      number: 80
      name: http-istio-gateway
      protocol: HTTP
    hosts:
    - "*"
    tls:
      httpsRedirect: true
  - port:
      number: 443
      name: https-istio-gateway
      protocol: HTTP
    hosts:
    - "*"
---
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: api-gateway
spec:
  gateways:
  - istio-gateway
  hosts:
  - "*"
  http:
  - match:
    - uri:
        prefix: /socket.io/
    route:
    - destination:
        host: api-gateway-ws.default.svc.cluster.local
        port:
          number: 5001
  - match:
    - uri:
        prefix: /
    route:
    - destination:
        host: api-gateway.default.svc.cluster.local
        port:
          number: 5000
</code></pre>

CC BY-SA 4.0
2019-05-20T22:34:27.977Z
What does the log indicate?
030
CC BY-SA 4.0
2019-05-25T19:28:08.613Z
@030: I think there is a problem with sync data between pilot and istio-proxy.
The first time I start my services, I unable to login. However, If I delete all services and start its again, it worked !
pcuong
<kubernetes><istio>
How to solve 'upstream connect error or disconnect/reset before headers. reset reason: connection termination' in Istio?
pcuong
# How to solve 'upstream connect error or disconnect/reset before headers. reset reason: connection termination' in Istio?

(Asked by: username_0 on 2019-05-19)

I try to setup an aws load balancer (ELB) with SSL follow the instruction at #6566
Certificate was attached on ELB.
However, I got the issue "upstream connect error or disconnect/reset before headers. reset reason: connection termination" when trying to access our web on browser.
Our setup without SSL has been worked before.
I use the custom values.yaml to install the istio (helm template):
helm template ./istio/install/kubernetes/helm/istio --name istio \
--namespace istio-system --values ./mesh/values.yaml | kubectl apply -f -

I have inserted below annotations to the gateways tag:
istio-ingressgateway:
    serviceAnnotations: 
      service.beta.kubernetes.io/aws-load-balancer-ssl-cert: "arn:aws:acm:ap-southeast-1:xxxxx:certificate/my-crt"
      service.beta.kubernetes.io/aws-load-balancer-backend-protocol: "http"
      service.beta.kubernetes.io/aws-load-balancer-ssl-ports: "https"

Here is my gateway.yaml:
apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: istio-gateway
spec:
  selector:
    istio: ingressgateway #default istio ingressgateway
  servers:
  - port:
      number: 80
      name: http-istio-gateway
      protocol: HTTP
    hosts:
    - "*"
    tls:
      httpsRedirect: true
  - port:
      number: 443
      name: https-istio-gateway
      protocol: HTTP
    hosts:
    - "*"
---
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: api-gateway
spec:
  gateways:
  - istio-gateway
  hosts:
  - "*"
  http:
  - match:
    - uri:
        prefix: /socket.io/
    route:
    - destination:
        host: api-gateway-ws.default.svc.cluster.local
        port:
          number: 5001
  - match:
    - uri:
        prefix: /
    route:
    - destination:
        host: api-gateway.default.svc.cluster.local
        port:
          number: 5000

**Tags:** kubernetes, istio

> **Comments:**
> **username_1**: What does the log indicate?  
> **username_0**: @username_1: I think there is a problem with sync data between pilot and istio-proxy. The first time I start my services, I unable to login. However, If I delete all services and start its again, it worked !  

---

## 5 answers

### Answer by username_2 on 2020-02-28. Score: 7

I encountered the same error but with a different issue. The Service port needed a name added to it. https://github.com/istio/istio/issues/19966. And they need to follow the format (protocol-suffix) https://istio.io/docs/ops/deployment/requirements/
ports:
    - name: https # Use http or https
       protocol: TCP
       port: 8080
       targetPort: 8080


---

### Answer by username_3 on 2020-08-06. Score: 4

This is most probably there is mismatch of the port that application running in the DOCKER is not the same port exposed in the DOCKER configuration

Docker file `EXPOSE`  should be same as the port the application is started.

Istio Ingress gateway can bind to the container port but can't communicate the application.


---

### Answer by username_0 on 2019-05-21. Score: 4

I have resolved the issue by update the gateway manifest.
Not sure why the error happen when adding multiple "match".
apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: istio-gateway
spec:
  selector:
    istio: ingressgateway #default istio ingressgateway
  servers:
  - port:
      number: 80
      name: http-istio-gateway
      protocol: HTTP
    hosts:
    - "*"
    tls:
      httpsRedirect: true
  - port:
      number: 443
      name: https-istio-gateway
      protocol: HTTP
    hosts:
    - "*"
---
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: api-gateway
spec:
  gateways:
  - istio-gateway
  hosts:
  - "*"
  http:
  - match:
    - uri:
        prefix: "/socket.io"
    route:
    - destination:
        host: api-gateway-ws.default.svc.cluster.local
        port:
          number: 5001
    websocketUpgrade: true
  - route:
    - destination:
        host: api-gateway.default.svc.cluster.local
        port:
          number: 5000


---

### Answer by username_4 on 2020-06-09. Score: 1

**Split large virtual services and destination rules into multiple resources:** The downside of your kind of configuration is that other configuration (e.g., route rules) for any of the underlying microservices, will need to also be included in this single configuration file.
Reference: <https://istio.io/docs/ops/best-practices/traffic-management/>[enter link description here](https://istio.io/docs/ops/best-practices/traffic-management/)


---

### Answer by username_5 on 2020-08-20. Score: 0

sometimes it happens when you apply Istio mTLS so first try to disable mTLS in the relevant namespace. (especially if you are using some kind of gRPC in the pod)
kubectl get peerauthentication --all-namespaces


---

