Create Istio Ingress-gateway POD without creating istiod

Question

I am bit new to istio and still learning. I have a use-case in which Istio is already deployed in istio-system namespace but I need to deploy istio ingress-gateway Pod in test-ns namespace using istioOperator. I am using istio 1.6.7.

From Istio docs, its mentioned to run this cmd: istioctl manifest apply --set profile=default --filename=istio-ingress-values.yaml but this will create istiod Pods in istio-system which i donot want since its already created.

So, I ran below cmds to just create Ingress Gateway POD but can;t see any Pods or services created in test-ns. Kindly help if this is possible

kubectl apply -f istio-ingress-values.yaml
apiVersion: install.istio.io/v1alpha1
kind: IstioOperator
metadata:
    namespace: test-ns
    name: testoperator
    ingressGateways:
    - enabled: true
      name: istio-ingressgateway
      namespace: test-ns
      k8s:
        env:
        - name: ISTIO_META_ROUTER_MODE
          value: sni-dnat
        hpaSpec:
          maxReplicas: 5
          metrics:
          - resource:
              name: cpu
              targetAverageUtilization: 80
            type: Resource
          minReplicas: 1
          scaleTargetRef:
            apiVersion: apps/v1
            kind: Deployment
            name: istio-ingressgateway
        resources: {}
        service:
          ports:
          - name: http2
            port: 80
            targetPort: 80
          - name: https
            port: 443
            targetPort: 443

Answer 1

In Istio it is possible to tune configuration profiles. As I can see, you are using the default profile, so I will describe how you can tune this configuration profile to create istio-ingressgateway in the test-ns namespace.

---

We can display the default profile settings by running the istioctl profile dump default command.

First, I saved these default settings in the default_profile_dump.yml file:

# istioctl profile dump default > default_profile_dump.yml

And then I modified this file:
NOTE: I only added one line: namespace: test-ns.

...
    ingressGateways:
    - enabled: true
      name: istio-ingressgateway
      namespace: test-ns
...

After modifying default settings of the ingressGateways, I applied these new settings:

# istioctl manifest apply -f default_profile_dump.yml 
This will install the Istio 1.9.1 default profile with ["Istio core" "Istiod" "Ingress gateways"] components into the cluster. Proceed? (y/N) y
✔ Istio core installed                                                                                                                                   
✔ Istiod installed                                                                                                                                       
✔ Ingress gateways installed                                                                                                                             
- Pruning removed resources                                                                                                                                Removed HorizontalPodAutoscaler:istio-system:istio-ingressgateway.
  Removed PodDisruptionBudget:istio-system:istio-ingressgateway.
  Removed Deployment:istio-system:istio-ingressgateway.
  Removed Service:istio-system:istio-ingressgateway.
  Removed ServiceAccount:istio-system:istio-ingressgateway-service-account.
  Removed RoleBinding:istio-system:istio-ingressgateway-sds.
  Removed Role:istio-system:istio-ingressgateway-sds.
✔ Installation complete   

     

Finally, we can check where istio-ingressgateway was deployed:

# kubectl get pod -A | grep ingressgateway
test-ns        istio-ingressgateway-7fc7c7c-r92tw         1/1     Running   0          33s

The istiod Deployment remained intact in the istio-system namespace:

# kubectl get deploy,pods -n istio-system
NAME                     READY   UP-TO-DATE   AVAILABLE   AGE
deployment.apps/istiod   1/1     1            1           51m

NAME                          READY   STATUS    RESTARTS   AGE
pod/istiod-64675984c5-xl97n   1/1     Running   0          51m