<h2>Question</h2>
<p>I am trying to learn Istio and I am setting up my Istio Ingress-Gateway.  When I set that up, there are the following port options (<a href="https://istio.io/latest/docs/reference/config/istio.operator.v1alpha1/#ServicePort" rel="nofollow noreferrer">as indicated here</a>):</p>
<ul>
<li>Port</li>
<li>NodePort</li>
<li>TargetPort</li>
</ul>
<p><code>NodePort</code> makes sense to me.  That is the port that the Ingress-Gateway will listen to on each worker node in the Kubernetes cluster.  Requests that hit there are going to route into the Kubernetes cluster using the Ingress Gateway CRDs.</p>
<p>In the examples, <code>Port</code> is usually set to the common port for its matching traffic (80 for http, and 443 for https, etc).  I don't understand what Istio needs this port for, as I don't see any traffic using anything but the NodePort.</p>
<p><code>TargetPort</code> is a mystery to me.  I have seen some documentation on it for normal Istio Gateways (that says it is <a href="https://istio.io/latest/docs/reference/config/networking/gateway/#Port" rel="nofollow noreferrer">only applicable when using ServiceEntries</a>), but nothing that makes sense for an Ingress-Gateway.</p>
<p><strong>My question is this, in relation to an Ingress-Gateway (not a normal Gateway) what is a <code>TargetPort</code>?</strong></p>
<h2>More Details</h2>
<p>In the end, I am trying to debug why my ingress traffic is getting a &quot;connection refused&quot; response.</p>
<p>I setup my Istio Operator <a href="https://istio.io/latest/docs/setup/install/operator/" rel="nofollow noreferrer">following this tutorial</a> with this configuration:</p>
<pre><code>apiVersion: install.istio.io/v1alpha1
kind: IstioOperator
metadata:
  name: istio-controlplane
  namespace: istio-system
spec:
  components:    
    ingressGateways:
    - enabled: true
      k8s:
        service:
          ports:
          - name: http2
            port: 80
            nodePort: 30980            
        hpaSpec:
          minReplicas: 2
      name: istio-ingressgateway
    pilot:
      enabled: true
      k8s:
        hpaSpec:
          minReplicas: 2
  profile: default
</code></pre>
<p>I omitted the <code>TargetPort</code> from my config because I found <a href="https://istio.io/latest/news/releases/1.7.x/announcing-1.7/upgrade-notes/#gateways-run-as-non-root" rel="nofollow noreferrer">this release notes</a> that said that Istio will pick safe defaults.</p>
<p>With that I tried to follow the steps found in <a href="https://istio.io/latest/docs/tasks/traffic-management/ingress/ingress-control/" rel="nofollow noreferrer">this tutorial</a>.</p>
<p>I tried the curl command indicated in that tutorial:</p>
<pre><code>curl -s -I -H Host:httpbin.example.com &quot;http://10.20.30.40:30980/status/200&quot;
</code></pre>
<p>I got the response of <code>Failed to connect to 10.20.30.40 port 30980: Connection refused</code></p>
<p>But I can ping <code>10.20.30.40</code> fine, and the command to get the NodePort returns <code>30980</code>.</p>
<p>So I got to thinking that maybe this is an issue with the <code>TargetPort</code> setting that I don't understand.</p>
<p>A check of the <code>istiod</code> logs hinted that I may be on the right track.  I ran:</p>
<pre><code>kubectl logs -n istio-system -l app=istiod
</code></pre>
<p>and among the logs I found:</p>
<pre><code>warn    buildGatewayListeners: skipping privileged gateway port 80 for node istio-ingressgateway-dc748bc9-q44j7.istio-system as it is an unprivileged pod
warn    gateway has zero listeners for node istio-ingressgateway-dc748bc9-q44j7.istio-system
</code></pre>
<p>So, if you got this far, then WOW!  I thank you for reading it all.  If you have any suggestions on what I need to set TargetPort to, or if I am missing something else, I would love to hear it.</p>

<p>Port, Nodeport and TargetPort are not Istio concepts, but Kubernetes ones, more specifically of Kubernetes Services, which is why there is no detailed description of that in the Istio Operator API.</p>
<p>The Istio Operator API exposes the options to configure the (Kubernetes) Service of the Ingress Gateway.</p>
<p>For a description of those concepts, see the documentation for <a href="https://kubernetes.io/docs/concepts/services-networking/service/" rel="nofollow noreferrer">Kubernetes Service</a>.</p>
<p>See also
<a href="https://stackoverflow.com/questions/49981601/difference-between-targetport-and-port-in-kubernetes-service-definition">Difference between targetPort and port in Kubernetes Service definition</a></p>
<p>So the target port is where the containers of the Pod of the Ingress Gateway receive their traffic.</p>
<p>Therefore I think, that the configuration of ports and target ports is application specific and the mapping 80-&gt;8080 is more or less arbitrary, i.e. a &quot;decision&quot; of the application.</p>
<p>Additional details:</p>
<p>The Istio Operator describes the Ingress Gateway, which itself consists of a Kubernetes Service and a Kubernetes Deployment. Usually it is deployed in istio-system. You can inspect the Kubernetes Service of istio-ingressgateway and it will match the specification of that YAML.</p>
<p>Therefore the Istio Ingress Gateway is actually talking to its containers.
However, this is mostly an implementation detail of the Istio Ingress Gateway and is not related to a Service and a VirtualService which you define for your apps.</p>
<p>The Ingressgateway is itself a Service and receives traffic on the port you define (i.e. 80) and forwards it to 8080 on its containers. Then it processes the traffic according to the rules which are configured by Gateways and VirtualServices and sends it to the Service of the application.</p>
