<p>I am trying to use of Istio in bare-metal and I wanted to use the minimum resources needed just to get an Ingress controller with Envoy and Cert-Manager (maybe later evolving to the use of more advanced service mesh features). I tried following this docs: <a href="https://istio.io/docs/tasks/traffic-management/ingress/ingress-certmgr/" rel="nofollow noreferrer">Istio Kubernetes Ingress with Cert-Manager</a> Demonstrates how to obtain Let's Encrypt TLS certificates for Kubernetes Ingress automatically using Cert-Manager.</p>

<p>My main problem is that I am in bare-metal and want to use neither LoadBalancer nor NodePort. I was going for a host-network approach as the analogous solution using nginx <a href="https://kubernetes.github.io/ingress-nginx/deploy/baremetal/#via-the-host-network" rel="nofollow noreferrer">here</a>. 1) Can I use istio to replace my current nginx-ingress controller with Hostnetwork?</p>

<p>Setup tried (with no success):</p>

<pre><code>helm install install/kubernetes/helm/istio-init --name istio-init --namespace istio-system
helm install install/kubernetes/helm/istio --name istio --namespace istio-system \
--values install/kubernetes/helm/istio/values-istio-minimal.yaml
</code></pre>

<p>2) If (1) is possible, can I use istio helm chart with istio-minimal (just istio-pilot) for that? What is the recommended minimal profile setup in this case?</p>

<p>The <em>istio.io</em> document for <a href="https://istio.io/docs/tasks/traffic-management/ingress/ingress-certmgr/" rel="nofollow noreferrer">Ingress with Cert-Manager</a> needs you to use the <code>ingress-gateway</code> object to attach it to a load balancer, so it's not an alternative in this case.</p>

<p>The Nginx approach is feasible as <a href="https://docs.cert-manager.io/en/latest/tutorials/acme/quick-start/" rel="nofollow noreferrer">you can use Cert-Manager with the Nginx ingress class</a> to automatically manage your certificates (replacing the Envoy-based Istio resources).</p>

<p>Now, the issue is that you have to redirect all the Nginx incoming traffic into the Istio mesh.</p>

<p>Although this is integration is not yet natively supported, <a href="https://github.com/kubernetes/ingress-nginx/issues/2126#issuecomment-367323042" rel="nofollow noreferrer">there are ways to make them work together</a> that might end up rather hacky.</p>

<p>Unless you're having an issue that is not described in the question, I don't think having the minimal Istio installation has any relationship with this scenario.</p>
