<p>Our GKE cluster is shared to multiple teams in company. Each team can have different public domain (and hence want to have different CA cert setup and also different ingress gateway controller). How to do that in Istio? All the tutorial/introduction articles in Istio's website are using a shared ingress gateway. See the example shared ingress gateway that comes installed by istio-1.0.0:
<a href="https://istio.io/docs/tasks/traffic-management/secure-ingress/" rel="noreferrer">https://istio.io/docs/tasks/traffic-management/secure-ingress/</a> </p>

<pre><code>spec:
  selector:
    istio: ingressgateway # use istio default ingress gateway
</code></pre>

<p>Okay, I found the answer after looking at the code of Istio installation via helm. So, basically the istio have an official way (but not really documented in their readme.md file) to add additional gateway (ingress and egress gateway). I know that because I found this <a href="https://github.com/istio/istio/blob/3a0daf1db0bd8a98a414abf7c21e9506a0839848/install/kubernetes/helm/istio/values-istio-gateways.yaml" rel="nofollow noreferrer">yaml file</a> in their github repo and read the comment (also looking at the <code>gateway</code> chart template code for the spec and its logic).</p>

<p>So, I solved this by, for example, defining this values-custom-gateway.yaml file:</p>

<pre><code># Gateways Configuration
# By default (if enabled) a pair of Ingress and Egress Gateways will be created for the mesh.
# You can add more gateways in addition to the defaults but make sure those are uniquely named
# and that NodePorts are not conflicting.
# Disable specifc gateway by setting the `enabled` to false.
#
gateways:
  enabled: true

  agung-ingressgateway:
    namespace: agung-ns
    enabled: true
    labels:
      app: agung-istio-ingressgateway
      istio: agung-ingressgateway
    replicaCount: 1
    autoscaleMin: 1
    autoscaleMax: 2
    resources: {}
      # limits:
      #  cpu: 100m
      #  memory: 128Mi
      #requests:
      #  cpu: 1800m
      #  memory: 256Mi

    loadBalancerIP: ""
    serviceAnnotations: {}
    type: LoadBalancer #change to NodePort, ClusterIP or LoadBalancer if need be

    ports:
      ## You can add custom gateway ports
    - port: 80
      targetPort: 80
      name: http2
      # nodePort: 31380
    - port: 443
      name: https
      # nodePort: 31390
    - port: 31400
      name: tcp
    secretVolumes:
    - name: ingressgateway-certs
      secretName: istio-ingressgateway-certs
      mountPath: /etc/istio/ingressgateway-certs
    - name: ingressgateway-ca-certs
      secretName: istio-ingressgateway-ca-certs
      mountPath: /etc/istio/ingressgateway-ca-certs
</code></pre>

<p>If you take a look at yaml file above, I specified the <code>namespace</code> other than <code>istio-system</code> ns. In this case, we can have a way to customize the TLS and ca cert being used by our custom gateway.
Also the <code>agung-ingressgateway</code> as the holder of the custom gateway controller spec is used as the gateway controller's name.</p>

<p>Then, i just install the istio via <code>helm upgrade --install</code> so that helm can intelligently upgrade the istio with additional gateway.</p>

<pre><code>helm upgrade my-istio-release-name &lt;istio-chart-folder&gt; --install
</code></pre>

<p>Once it upgrades successfully, I can specify custom selector to my <code>Gateway</code>:</p>

<pre><code>---
apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: agung-gateway
  namespace: agung-ns
spec:
  selector:
    app: agung-istio-ingressgateway # use custom gateway
    # istio: ingressgateway # use Istio default gateway implementation
  servers:
  - port:
      number: 80
      name: http
      protocol: HTTP
    hosts:
    - "*"
  - port:
      number: 443
      name: https
      protocol: HTTPS
    tls:
      mode: SIMPLE
      serverCertificate: /etc/istio/ingressgateway-certs/tls.crt
      privateKey: /etc/istio/ingressgateway-certs/tls.key
    hosts:
    - "*"
</code></pre>
