Istio (1.0) intra ReplicaSet routing - support traffic between pods in a Kubernetes Deployment

You are right that HTTP routing only supports local access or remote access by service name or service VIP.

That said, for your particular example, above, where the service ports are named "one", "two", "three", the routing will be plain TCP as described here. Therefore, your example should work. The pod ispn-perf-test-558666c5c6-g9jb5 can reach itself on 10.44.4.63 and the other pods at 10.44.4.64 and 10.44.3.22.

If you rename the ports to "http-one", "http-two", and "http-three" then HTTP routing will kick in and the RDS config will restrict the remote calls to ones using recognized service domains.

To see the difference in the RDF config look at the output from the following command when the port is named "one", and when it is changed to "http-one".

istioctl proxy-config routes ispn-perf-test-558666c5c6-g9jb5 -n my-istio-namespace  --name 7800 -o json

With the port named "one" it will return no routes, so TCP routing will apply, but in the "http-one" case, the routes will be restricted.

I don't know if there is a way to add additional remote pod IP addresses to the RDS domains in the HTTP case. I would suggest opening an Istio issue, to see if it's possible.