Tcp port not working with ingressgateway

[sheetalmane4]

Hi,

tcp protocol based gateway is not working .

Created a tcp/2347 port based gateway and this port is not reachable.

According to link (https://istio.io/latest/docs/reference/config/analysis/ist0104/), do I need to add port 2347 during istio installation only?
This tcp/2347 can not be added at run time (post istio installation) using istio resource Gateway/ VirtualService?

istio version

V1.9.1

istio installation (my-config.yaml is attached)
$ istioctl install -f my-config.yaml -y

create a tcp-echo2 server, gateway, virtual service (tcp-echo-server.yaml is attached)
$ kubectl -n tcp create -f tcp-echo-server.yaml

ingress gateway pod is listing on port tcp/2347
$ netstat -nlt |grep 2347
tcp 0 0 0.0.0.0:2347 0.0.0.0:* LISTEN

istio analyse is giving below warning
$ istioctl analyze -n tcp
Warning [IST0104] (Gateway tcp-echo2-gateway.tcp) The gateway refers to a port that is not exposed on the workload (pod selector istio=ingressgateway; port 2347)
$

port is not reachable via ingressgateway service
$ nc istio-ingressgateway.istio-system.svc.cluster.local 2347
Ncat: Connection timed out.
$

[sheetalmane4]

@sheetalmane4

#my-config.yaml
apiVersion: install.istio.io/v1alpha1
kind: IstioOperator
spec:
components:
base:
enabled: true
cni:
enabled: false
egressGateways:
- enabled: true
name: istio-egressgateway
ingressGateways:
- enabled: true
k8s:
service:
ports:
- name: status-port
port: 15021
targetPort: 15021
- name: http2
port: 7080
targetPort: 7080
- name: https
port: 8443
targetPort: 8443
- name: tcp
port: 31400
targetPort: 31400
- name: tcp2
port: 2345
targetPort: 2345
- name: tls
port: 15443
targetPort: 15443
name: istio-ingressgateway
values:
gateways:
istio-egressgateway:
type: NodePort
istio-ingressgateway:
type: NodePort
global:
logging:
level: default:info
proxy:
logLevel: debug
meshConfig:
accessLogFile: /dev/stdout

istio installation file

[sheetalmane4]

@sheetalmane4

apiVersion: v1
kind: Service
metadata:
name: tcp-echo2
labels:
app: tcp-echo2
service: tcp-echo2
spec:
ports:

• name: tcp
  port: 9000
• name: tcp-other
  port: 9001

Port 9002 is omitted intentionally for testing the pass through filter chain.

selector:
app: tcp-echo2

apiVersion: apps/v1
kind: Deployment
metadata:
name: tcp-echo2-v1
labels:
app: tcp-echo2
version: v1
spec:
replicas: 1
selector:
matchLabels:
app: tcp-echo2
version: v1
template:
metadata:
labels:
app: tcp-echo2
version: v1
spec:
containers:
- name: tcp-echo2
image: docker.io/istio/tcp-echo-server:1.2
imagePullPolicy: IfNotPresent
args: [ “9000,9001,9002”, “four” ]
ports:
- containerPort: 9000
- containerPort: 9001

---

apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
name: tcp-echo2-gateway
spec:
selector:
istio: ingressgateway
servers:

• port:
  number: 2347
  name: tcp
  protocol: TCP
  hosts:
  • “*”

---

apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
name: tcp-echo2-destination
spec:
host: tcp-echo2
subsets:

• name: v1
  labels:
  version: v1
• name: v2
  labels:
  version: v2

---

apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
name: tcp-echo2
spec:
hosts:

• “*”
  gateways:
• tcp-echo2-gateway
  tcp:
• match:
  • port: 2347
    route:
  • destination:
    host: tcp-echo2
    port:
    number: 9000
    subset: v1

tcp-echo-server.yaml file

[sheetalmane4]

more logs for the error scenario.
here we are not able to reach istio gateway using below command from within k8 cluster

nc istio-ingressgateway.istio-system.svc.cluster.local 2347 Ncat: Connection timed out.

istioctl pc listener -n istio-system (kubectl get pods -n istio-system -l app=istio-ingressgateway -o jsonpath=’{.items…metadata.name}’)
ADDRESS PORT MATCH DESTINATION
0.0.0.0 2345 ALL Cluster: outbound|2345||tcpserver.sdlnw.svc.cluster.local
0.0.0.0 2347 ALL Cluster: outbound|2347||tcpserver2.sdlnw.svc.cluster.local
0.0.0.0 15021 ALL Inline Route: /healthz/ready*
0.0.0.0 15090 ALL Inline Route: /stats/prometheus*

kubectl -n istio-system exec -it (kubectl get pods -n istio-system -l app=istio-ingressgateway -o jsonpath=’{.items…metadata.name}’) – netstat -nlt
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address Foreign Address State
tcp 0 0 0.0.0.0:15090 0.0.0.0:* LISTEN
tcp 0 0 127.0.0.1:15000 0.0.0.0:* LISTEN
tcp 0 0 0.0.0.0:2345 0.0.0.0:* LISTEN
tcp 0 0 0.0.0.0:2347 0.0.0.0:* LISTEN
tcp 0 0 0.0.0.0:15021 0.0.0.0:* LISTEN
tcp6 0 0 :::15020 :::* LISTEN