<p>I have an example istio cluster on AKS with the default ingress gateway. Everything works as expected I'm just trying to understand how. The Gateway is defined like so:</p>
<pre><code>apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: my-gateway
  namespace: some-config-namespace
spec:
  selector:
    app: istio-ingressgateway
  servers:
  - port:
      number: 80
      name: http
      protocol: HTTP
    hosts:
    - uk.bookinfo.com
    - eu.bookinfo.com
    tls:
      httpsRedirect: true # sends 301 redirect for http requests
  - port:
      number: 443
      name: https-443
      protocol: HTTPS
    hosts:
    - uk.bookinfo.com
    - eu.bookinfo.com
    tls:
      mode: SIMPLE # enables HTTPS on this port
      serverCertificate: /etc/certs/servercert.pem
      privateKey: /etc/certs/privatekey.pem
</code></pre>
<p>Reaching the site on <a href="https://uk.bookinfo.com" rel="nofollow noreferrer">https://uk.bookinfo.com</a> works fine. However when I look at the LB and Service that goes to the ingressgateway pods I see this:</p>
<pre><code>LB-IP:443 -&gt; CLUSTER-IP:443 -&gt; istio-ingressgateway:8443
</code></pre>
<pre><code>kind: Service
spec:
  ports:
    - name: http2
      protocol: TCP
      port: 80
      targetPort: 8080
      nodePort: 30804
    - name: https
      protocol: TCP
      port: 443
      targetPort: 8443
      nodePort: 31843
  selector:
    app: istio-ingressgateway
    istio: ingressgateway
  clusterIP: 10.2.138.74
  type: LoadBalancer
</code></pre>
<p>Since the targetPort for the istio-ingressgateway pods is <strong>8443</strong> then how does the Gateway definition work which defines a port number as <strong>443</strong>?</p>

<p>As mentioned <a href="https://stackoverflow.com/a/61452441/11977760">here</a></p>
<blockquote>
<p>port: The port of this service</p>
<p>targetPort: The target port on the pod(s) to forward traffic to</p>
</blockquote>
<p>As far as I know <code>targetPort: 8443</code> points to envoy sidecar, so If I understand correctly envoy listen on 8080 for http and 8443 for https.</p>
<p>There is an example in envoy <a href="https://www.envoyproxy.io/docs/envoy/latest/start/sandboxes/front_proxy?fbclid=IwAR3CnWf8HpHko-434T_n69pnZDFXQMvjUnVa38MHf9hjU-JVmuTtlmwsZNE" rel="nofollow noreferrer">documentation</a>.</p>
<p>So it goes like this:</p>
<pre><code>LB-IP:443 -&gt; CLUSTER-IP:443 -&gt; istio-ingressgateway:443 -&gt; envoy-sidecar:8443
LB-IP:80 -&gt; CLUSTER-IP:80 -&gt; istio-ingressgateway:80 -&gt; envoy-sidecar:8080
</code></pre>
<hr />
<p>For example, for http if you check your ingress-gateway pod with netstat without any gateway configured there isn't anything listening on port 8080:</p>
<pre><code>kubectl exec -ti istio-ingressgateway-86f88b6f6-r8mjt -n istio-system -c istio-proxy -- /bin/bash
istio-proxy@istio-ingressgateway-86f88b6f6-r8mjt:/$ netstat -lnt | grep 8080
</code></pre>
<p>Let's create a http gateway now with below yaml.</p>
<pre><code>apiVersion: networking.istio.io/v1beta1
kind: Gateway
metadata:
  name: istio-gw
  namespace: istio-system
spec:
  selector:
    istio: ingressgateway
  servers:
  - port:
      number: 80
      name: http
      protocol: HTTP
    hosts:
    - &quot;*&quot;
</code></pre>
<p>And check with netstat again:</p>
<pre><code>kubectl exec -ti istio-ingressgateway-86f88b6f6-r8mjt -n istio-system -c istio-proxy -- /bin/bash
istio-proxy@istio-ingressgateway-86f88b6f6-r8mjt:/$ netstat -lnt | grep 8080
tcp        0      0 0.0.0.0:8080            0.0.0.0:*               LISTEN
</code></pre>
<p>As you can see we have configured gateway on port 80, but inside the ingressgateway we can see that it's listening on port 8080.</p>
