Istio without Gateway with nginx-ingress


Hello Everyone,

I use nginx as ingress and are not ready to leave nginx as our nginx does few conditional header manipulation before routing that is not possible with istio’s “virtualService”.

I want to use istio’s traffic routing features such as canary, mirroring, timeout and telemetery features such as prometheus, Jaeger and Graphana and may be few mixer policies but want nginx-ingress as entry point to the cluster and still able to take use of traffic routing.

Can someone guide me on how to achieve this ?



See GH Issue: looking for migration guide from nginx ingress to istio

When deploying nginx-ingress you can add the following pod annotation to tell istio to NOT intercept incoming traffic to nginx-ingress. ""

Then for outbound traffic you can setup 2 annotations on your Ingress to avoid using endpoints directly and use istio instead. nginx "true" <svc name>.<namespace>.svc.cluster.local


Thanks for your help Dev. I looked into that GH issue you mentioned. I still have few doubts.

First, I am not using “kind: Ingress” object. I am just using an nginx deployment that takes care of TLS termination and call routing.

Second, In “”, He has mentioned he is not able to make use of “virtualservice” when using nginx ast the frontend but is able to make use of “virtualservice” when Gateway is friontend. I am facing the same problem.

If I have to use annotation is someway, can I use them even If I dont use “kind: ingress” object of kubernetes ?


Can someone help with this ?

I want to use nginx in front of pods which will have envoy in them. and i want to use istio’s traffic routing features using “virtualservices”.

I wont be using gateway at all.