100%
trace: POST /v2/orders host=api.acme.com x-canary:true
✔ rule #1 MATCHED — matched
result: rule #1 of prod/api-routes matches → api.prod:8080 subset v2 (80%), api.prod:8080 subset v3 (20%)

▾gateway istio-system/public-gateway — :443 HTTPS (SIMPLE TLS)4 hosts · 13 rules

90% 10% mirror 25% HTTP 301 → https://www.acme.com/HTTP 301 → https://www.acme.com/ URI prefix / ⤳ redirect 301URI prefix /⤳ redirect 3011 acme.com vs: apex-redirect · prodacme.comvs: apex-redirect · prod direct response 200direct response 200 URI exact /healthz ▣ direct 200URI exact /healthz▣ direct 2001 HTTP 301 → /HTTP 301 → / URI exact /home ⤳ redirect 301URI exact /home⤳ redirect 3012 static-assets.prod:80static-assets.prod:80 URI prefix /assets ✂ rewrite / ⏱ timeout 3s ≡ headersURI prefix /assets✂ rewrite / ⏱ timeout 3s ≡ headers3 web.prod:80 subset: stable (track=stable)web.prod:80subset: stable (track=stable) web.prod:80 subset: canary (track=canary)web.prod:80subset: canary (track=canary) URI prefix /shop ↻ retry 3xURI prefix /shop↻ retry 3x4 search.prod:8080search.prod:8080 recommendations.prod:8080recommendations.prod:8080 URI regex /search/[a-z0-9-]+ (case-insensitive) AND ?q regex .+ AND ?page=1 AND ?debug present 🪞 mirrorURI regex /search/[a-z0-9-]+ (case-insensitive)AND ?q regex .+AND ?page=1AND ?debug present🪞 mirror5 header x-acme-channel regex beta|canary AND header x-opt-out absent OR header cookie prefix acme_beta= ⚡ fault ◌ CORSheader x-acme-channel regex beta|canaryAND header x-opt-out absentORheader cookie prefix acme_beta=⚡ fault ◌ CORS6 URI prefix /account AND method GET|HEAD ✂ rewrite regex ≡ headersURI prefix /accountAND method GET|HEAD✂ rewrite regex ≡ headers7 URI prefix /URI prefix /8 www.acme.com vs: storefront · prodwww.acme.comvs: storefront · prod URI prefix /app AND authority regex [a-z0-9-]+\.tenants\.acme\.comURI prefix /appAND authority regex [a-z0-9-]+\.tenants\.acme\.com1 /* (catch-all)/* (catch-all)2 *.tenants.acme.com vs: tenant-sites · prod*.tenants.acme.comvs: tenant-sites · prod internal-portal.prod:8080internal-portal.prod:8080 URI prefix / AND sourceLabels team=platformURI prefix /AND sourceLabels team=platform1 /* (catch-all)/* (catch-all)2 internal.acme.com vs: internal-portal · prodinternal.acme.comvs: internal-portal · prod istio-system/public-gateway :443 HTTPS (SIMPLE TLS) acme.com www.acme.com *.acme.comistio-system/public-gateway:443 HTTPS (SIMPLE TLS)acme.comwww.acme.com*.acme.com Client

▾gateway istio-system/public-gateway — :80 HTTP4 hosts · 13 rules

90% 10% mirror 25% HTTP 301 → https://www.acme.com/HTTP 301 → https://www.acme.com/ URI prefix / ⤳ redirect 301URI prefix /⤳ redirect 3011 acme.com vs: apex-redirect · prodacme.comvs: apex-redirect · prod direct response 200direct response 200 URI exact /healthz ▣ direct 200URI exact /healthz▣ direct 2001 HTTP 301 → /HTTP 301 → / URI exact /home ⤳ redirect 301URI exact /home⤳ redirect 3012 static-assets.prod:80static-assets.prod:80 URI prefix /assets ✂ rewrite / ⏱ timeout 3s ≡ headersURI prefix /assets✂ rewrite / ⏱ timeout 3s ≡ headers3 web.prod:80 subset: stable (track=stable)web.prod:80subset: stable (track=stable) web.prod:80 subset: canary (track=canary)web.prod:80subset: canary (track=canary) URI prefix /shop ↻ retry 3xURI prefix /shop↻ retry 3x4 search.prod:8080search.prod:8080 recommendations.prod:8080recommendations.prod:8080 URI regex /search/[a-z0-9-]+ (case-insensitive) AND ?q regex .+ AND ?page=1 AND ?debug present 🪞 mirrorURI regex /search/[a-z0-9-]+ (case-insensitive)AND ?q regex .+AND ?page=1AND ?debug present🪞 mirror5 header x-acme-channel regex beta|canary AND header x-opt-out absent OR header cookie prefix acme_beta= ⚡ fault ◌ CORSheader x-acme-channel regex beta|canaryAND header x-opt-out absentORheader cookie prefix acme_beta=⚡ fault ◌ CORS6 URI prefix /account AND method GET|HEAD ✂ rewrite regex ≡ headersURI prefix /accountAND method GET|HEAD✂ rewrite regex ≡ headers7 URI prefix /URI prefix /8 www.acme.com vs: storefront · prodwww.acme.comvs: storefront · prod URI prefix /app AND authority regex [a-z0-9-]+\.tenants\.acme\.comURI prefix /appAND authority regex [a-z0-9-]+\.tenants\.acme\.com1 /* (catch-all)/* (catch-all)2 *.tenants.acme.com vs: tenant-sites · prod*.tenants.acme.comvs: tenant-sites · prod internal-portal.prod:8080internal-portal.prod:8080 URI prefix / AND sourceLabels team=platformURI prefix /AND sourceLabels team=platform1 /* (catch-all)/* (catch-all)2 internal.acme.com vs: internal-portal · prodinternal.acme.comvs: internal-portal · prod istio-system/public-gateway :80 HTTP acme.com www.acme.com *.acme.comistio-system/public-gateway:80 HTTPacme.comwww.acme.com*.acme.com Client

▾gateway istio-system/public-gateway — :8080 HTTP1 host · 2 rules

internal-portal.prod:8080internal-portal.prod:8080 URI prefix / AND sourceLabels team=platformURI prefix /AND sourceLabels team=platform1 /* (catch-all)/* (catch-all)2 internal.acme.com vs: internal-portal · prodinternal.acme.comvs: internal-portal · prod istio-system/public-gateway :8080 HTTP internal.acme.comistio-system/public-gateway:8080 HTTPinternal.acme.com Client

▾gateway istio-system/api-gateway — :443 HTTPS (MUTUAL TLS)1 host · 6 rules

80% 20% mirror mirror 10% api.prod:8080 subset: v2 (version=v2)api.prod:8080subset: v2 (version=v2) api.prod:8080 subset: v3 (version=v3)api.prod:8080subset: v3 (version=v3) api-shadow.prod:8080api-shadow.prod:8080 URI prefix /v2 AND method POST AND header x-canary exact true ⏱ timeout 5s ↻ retry 3x 🪞 mirrorURI prefix /v2AND method POSTAND header x-canary exact true⏱ timeout 5s ↻ retry 3x 🪞 mirror1 cart.prod:8080cart.prod:8080 URI prefix /v2/cart AND scheme exact https AND header authorization presentURI prefix /v2/cartAND scheme exact httpsAND header authorization present2 catalog.prod:8080catalog.prod:8080 URI prefix /v2/catalog AND ?category regex .+URI prefix /v2/catalogAND ?category regex .+3 payments.payments:8080 subset: v2 (version=v2)payments.payments:8080subset: v2 (version=v2) URI prefix /v2/payments AND port 443URI prefix /v2/paymentsAND port 4434 api.prod:8080 subset: v1 (version=v1)api.prod:8080subset: v1 (version=v1) URI prefix /v2 ✂ rewrite / 🪞 mirrorURI prefix /v2✂ rewrite / 🪞 mirror5 HTTP 302 → /v2HTTP 302 → /v2 URI prefix /v1 ⤳ redirect 302URI prefix /v1⤳ redirect 3026 api.acme.com vs: api-routes · prodapi.acme.comvs: api-routes · prod istio-system/api-gateway :443 HTTPS (MUTUAL TLS) api.acme.comistio-system/api-gateway:443 HTTPS (MUTUAL TLS)api.acme.com Client

▾gateway istio-system/grpc-gateway — :8443 GRPC (SIMPLE TLS)1 host · 2 rules

api.prod:9090api.prod:9090 URI prefix /acme.orders.v1.Orders/ ⏱ timeout 10s ↻ retry 2xURI prefix /acme.orders.v1.Orders/⏱ timeout 10s ↻ retry 2x1 /* (catch-all)/* (catch-all)2 grpc.acme.com vs: grpc-routes · prodgrpc.acme.comvs: grpc-routes · prod istio-system/grpc-gateway :8443 GRPC (SIMPLE TLS) grpc.acme.comistio-system/grpc-gateway:8443 GRPC (SIMPLE TLS)grpc.acme.com Client

▾gateway istio-system/grpc-gateway — :9090 HTTP21 host · 1 rule

stream.prod:9090stream.prod:9090 /* (catch-all)/* (catch-all)1 stream.acme.com vs: stream-routes · prodstream.acme.comvs: stream-routes · prod istio-system/grpc-gateway :9090 HTTP2 stream.acme.comistio-system/grpc-gateway:9090 HTTP2stream.acme.com Client

▾gateway istio-system/edge-l4-gateway — :15443 TLS (PASSTHROUGH TLS)0 hosts · 0 rules

istio-system/edge-l4-gateway :15443 TLS (PASSTHROUGH TLS) secure.acme.comistio-system/edge-l4-gateway:15443 TLS (PASSTHROUGH TLS)secure.acme.com Client

▾gateway istio-system/edge-l4-gateway — :3306 TCP0 hosts · 0 rules

istio-system/edge-l4-gateway :3306 TCP db.acme.comistio-system/edge-l4-gateway:3306 TCPdb.acme.com Client

▾mesh routing (no gateway)3 hosts · 5 rules

orders.internal:8080 subset: v2 (version=v2)orders.internal:8080subset: v2 (version=v2) header x-experiment exact orders-v2header x-experiment exact orders-v21 orders.internal:8080 subset: v1 (version=v1)orders.internal:8080subset: v1 (version=v1) /* (catch-all) ⚡ fault/* (catch-all)⚡ fault2 orders vs: orders-mesh · internalordersvs: orders-mesh · internal inventory.internal:8080inventory.internal:8080 URI prefix /read AND method GET|HEAD ⏱ timeout 1sURI prefix /readAND method GET|HEAD⏱ timeout 1s1 URI prefix /write AND method POST ↻ retry 2xURI prefix /writeAND method POST↻ retry 2x2 inventory vs: inventory-mesh · internalinventoryvs: inventory-mesh · internal notifications.internal:8080notifications.internal:8080 /* (catch-all)/* (catch-all)1 notifications vs: notifications-mesh · internalnotificationsvs: notifications-mesh · internal mesh (sidecar routing)mesh(sidecar routing) Client
web.prod:80(stable)web.prod:80(stable) * from prod/tenant-sites* /app* {authority~[a-z0-9-]+\.tenants\.acme\.com} from prod/tenant-sites/app* {authority~[a-z0-9-]+\.tenants\.acme\.com} *.tenants.acme.com via istio-system/public-gateway:443 via istio-system/public-gateway:80*.tenants.acme.comvia istio-system/public-gateway:443via istio-system/public-gateway:80
redirect:301:https://www.acme.com/redirect:301:https://www.acme.com/ /* from prod/apex-redirect/* acme.com via istio-system/public-gateway:443 via istio-system/public-gateway:80acme.comvia istio-system/public-gateway:443via istio-system/public-gateway:80
80% 20% redirect:302:/v2redirect:302:/v2 /v1* from prod/api-routes/v1* api.prod:8080(v1)api.prod:8080(v1) /v2* mirror api-shadow.prod:8080=10% rewrite / from prod/api-routes/v2*mirror api-shadow.prod:8080=10% rewrite / api.prod:8080(v2)api.prod:8080(v2) api.prod:8080(v3)api.prod:8080(v3) /v2* {header x-canary=true, method=POST} mirror api-shadow.prod:8080 retry 3x timeout 5s from prod/api-routes/v2* {header x-canary=true, method=POST}mirror api-shadow.prod:8080 retry 3x timeout 5s cart.prod:8080cart.prod:8080 /v2/cart* {header authorization, scheme=https} from prod/api-routes/v2/cart* {header authorization, scheme=https} catalog.prod:8080catalog.prod:8080 /v2/catalog* {?category~.+} from prod/api-routes/v2/catalog* {?category~.+} payments.payments:8080(v2)payments.payments:8080(v2) /v2/payments* {port=443} from prod/api-routes/v2/payments* {port=443} api.acme.com via istio-system/api-gateway:443api.acme.comvia istio-system/api-gateway:443
api.prod:9090api.prod:9090 * from prod/grpc-routes* /acme.orders.v1.Orders/* retry 2x timeout 10s from prod/grpc-routes/acme.orders.v1.Orders/*retry 2x timeout 10s grpc.acme.com via istio-system/grpc-gateway:8443grpc.acme.comvia istio-system/grpc-gateway:8443
internal-portal.prod:8080internal-portal.prod:8080 * from prod/internal-portal* /* {sourceLabel team=platform} from prod/internal-portal/* {sourceLabel team=platform} internal.acme.com via istio-system/public-gateway:443 via istio-system/public-gateway:80 via istio-system/public-gateway:8080internal.acme.comvia istio-system/public-gateway:443via istio-system/public-gateway:80via istio-system/public-gateway:8080
inventory.internal:8080inventory.internal:8080 /read* {method~GET|HEAD} timeout 1s from internal/inventory-mesh/read* {method~GET|HEAD}timeout 1s /write* {method=POST} retry 2x from internal/inventory-mesh/write* {method=POST}retry 2x inventory via meshinventoryvia mesh
notifications.internal:8080notifications.internal:8080 * from internal/notifications-mesh* notifications via meshnotificationsvia mesh
orders.internal:8080(v1)orders.internal:8080(v1) * fault from internal/orders-mesh*fault orders.internal:8080(v2)orders.internal:8080(v2) * {header x-experiment=orders-v2} from internal/orders-mesh* {header x-experiment=orders-v2} orders via meshordersvia mesh
stream.prod:9090stream.prod:9090 * from prod/stream-routes* stream.acme.com via istio-system/grpc-gateway:9090stream.acme.comvia istio-system/grpc-gateway:9090
90% 10% web.prod:80(canary)web.prod:80(canary) * {!header x-opt-out, header x-acme-channel~beta|canary} CORS fault from prod/storefront* {!header x-opt-out, header x-acme-channel~beta|canary}CORS fault * {header cookie^=acme_beta=} CORS fault from prod/storefront* {header cookie^=acme_beta=}CORS fault web.prod:80(stable)web.prod:80(stable) /* from prod/storefront/* /account* {method~GET|HEAD} headers rewrite regex from prod/storefront/account* {method~GET|HEAD}headers rewrite regex static-assets.prod:80static-assets.prod:80 /assets* headers rewrite / timeout 3s from prod/storefront/assets*headers rewrite / timeout 3s direct:200direct:200 /healthz from prod/storefront/healthz redirect:301:/redirect:301:/ /home from prod/storefront/home /shop* retry 3x from prod/storefront/shop*retry 3x search.prod:8080search.prod:8080 ~/search/[a-z0-9-]+ {?debug, ?page=1, ?q~.+} mirror recommendations.prod:8080=25% from prod/storefront~/search/[a-z0-9-]+ {?debug, ?page=1, ?q~.+}mirror recommendations.prod:8080=25% www.acme.com via istio-system/public-gateway:443 via istio-system/public-gateway:80www.acme.comvia istio-system/public-gateway:443via istio-system/public-gateway:80

*.tenants.acme.com

via istio-system/public-gateway:443, istio-system/public-gateway:80
*→web.prod:80(stable)
/app* {authority~[a-z0-9-]+\.tenants\.acme\.com}→web.prod:80(stable)

acme.com

via istio-system/public-gateway:443, istio-system/public-gateway:80
/*→redirect:301:https://www.acme.com/

api.acme.com

via istio-system/api-gateway:443
/v1*→redirect:302:/v2
/v2*→api.prod:8080(v1)mirror api-shadow.prod:8080=10%, rewrite /
/v2* {header x-canary=true, method=POST}→api.prod:8080(v2)=80% api.prod:8080(v3)=20%mirror api-shadow.prod:8080, retry 3x, timeout 5s
/v2/cart* {header authorization, scheme=https}→cart.prod:8080
/v2/catalog* {?category~.+}→catalog.prod:8080
/v2/payments* {port=443}→payments.payments:8080(v2)

grpc.acme.com

via istio-system/grpc-gateway:8443
*→api.prod:9090
/acme.orders.v1.Orders/*→api.prod:9090retry 2x, timeout 10s

internal.acme.com

via istio-system/public-gateway:443, istio-system/public-gateway:80, istio-system/public-gateway:8080
*→internal-portal.prod:8080
/* {sourceLabel team=platform}→internal-portal.prod:8080

inventory

via mesh
/read* {method~GET|HEAD}→inventory.internal:8080timeout 1s
/write* {method=POST}→inventory.internal:8080retry 2x

notifications

via mesh
*→notifications.internal:8080

orders

via mesh
*→orders.internal:8080(v1)fault
* {header x-experiment=orders-v2}→orders.internal:8080(v2)

stream.acme.com

via istio-system/grpc-gateway:9090
*→stream.prod:9090

www.acme.com

via istio-system/public-gateway:443, istio-system/public-gateway:80
* {!header x-opt-out, header x-acme-channel~beta|canary}→web.prod:80(canary)CORS, fault
* {header cookie^=acme_beta=}→web.prod:80(canary)CORS, fault
/*→web.prod:80(stable)
/account* {method~GET|HEAD}→web.prod:80(stable)headers, rewrite regex
/assets*→static-assets.prod:80headers, rewrite /, timeout 3s
/healthz→direct:200
/home→redirect:301:/
/shop*→web.prod:80(stable)=90% web.prod:80(canary)=10%retry 3x
~/search/[a-z0-9-]+ {?debug, ?page=1, ?q~.+}→search.prod:8080mirror recommendations.prod:8080=25%