How to setup Istio with Private AKS Cluster?

Hello Guys,

Is there any links/articles/leads on how to setup Istio with Private AKS Cluster ?
To be more specific, Istio deploys Gateways with External IP’s but the idea of a Private AKS cluster is to not have any EXTERNAL IP’s.
How do we create Istio G/W with only INTERNAL IP on an AKS cluster by using istioctl ?


I believe you can add serviceAnnotations: to your gateway to use internal loadbalancer over public loadbalancer. Below example is for google cloud.

So how do we change the annotations for a default profile ? Should I create a dump of the default profile and add annotations to ingressGateways block ? Is that the best way to do it ?

You should be able to add annotations using the value overrides with IstioOperator config:
kind: IstioOperator
name: istio-operator
- enabled: true
- kind: Service
name: istio-ingressgateway
- path: spec.type
value: LoadBalancer
serviceAnnotations: “true”

You can use this to generate manifest and verify if the annotations are being added to the ingress service.

MS link for adding the annotations for internal LB:

Great! I was able to spin it up with a custom manifest file. Here is what I did:

  1. Installed Istio Operator:
  2. Created a dump of the “demo” profile.
  3. Added the required annotation to the ingressGateways block along with required ports and created a custom manifest file.
  4. Applied it using istioctl.