Custom IngressGateway

1

What is the preferred way to add a custom ingressgateway with a different name on an already running cluster? I’m assuming an installation with the istio-operator running would provide a better approach for it, and that’s how I’m doing it.
Using the bellow approach:

apiVersion: install.istio.io/v1alpha1
kind: IstioOperator
metadata:
  name: custom-ingressgateway
  namespace: istio-system
spec:
  components:
    ingressGateways:
    - enabled: true
      name: custom-ingressgateway
      k8s:
        env:
        - name: ISTIO_META_ROUTER_MODE
          value: sni-dnat
        hpaSpec:
          maxReplicas: 5
          metrics:
          - resource:
              name: cpu
              targetAverageUtilization: 80
            type: Resource
          minReplicas: 1
          scaleTargetRef:
            apiVersion: apps/v1
            kind: Deployment
            name: custom-ingressgateway
        resources:
          limits:
            cpu: 2000m
            memory: 1024Mi
          requests:
            cpu: 100m
            memory: 128Mi
        service:
          ports:
          - name: status-port
            port: 15021
            targetPort: 15021
          - name: http2
            port: 80
            targetPort: 8080
          - name: https
            port: 443
            targetPort: 8443
          - name: tls
            port: 15443
            targetPort: 15443
        strategy:
          rollingUpdate:
            maxSurge: 100%
            maxUnavailable: 25%
2

You can either specify is as a separate CR as you have or merge it with the main CR. The operator will apply changes from any IstioOperator CR in the watched namespace. Note that it won’t merge the CR’s before applying so with the above CR you will apply the base resources twice. To avoid that, you could use the empty profile.

3

You’ve kinda almost nailed my next question. So that way, the idea was to be able to deploy and delete separate gateways on the fly, so I think the strategy would be to keep using separate CRs. That being said, when I removed my custom-gateway, it removed Prometheus together with it, which I think is caused by the problem that you stated about re-deploying control panel and other stuff. Now, to use the empty profile as you said should I use:

profile: empty

or should I try something like:

  components:
    base:
      enabled: false
    pilot:
      enabled: false
 addonComponents:
    prometheus:
      enabled: false

Thanks!

4

Actually what I told you isn’t quite right. If you use empty, the CR based on that profile will remove things rather than ignoring them and the two CRs will fight. This would only work if you istioctl manifest generate YAML for the gateway only using empty profile and kubectl apply it yourself.
The easiest way to add another gateway it to add it to the main CR and keep it as the only CR. The operator watches the CR and applies any changes immediately. With this approach you don’t have to worry about potential conflicts between multiple CRs in the cluster.