<p>I deployed Istio <a href="https://istio.io/latest/docs/setup/install/operator/" rel="nofollow noreferrer">using the operator</a> and added a custom ingress gateway which is only accessible from a certain source range (our VPN).</p>
<pre><code>apiVersion: install.istio.io/v1alpha1
kind: IstioOperator
metadata:
  namespace: istio-system
  name: ground-zero-ingressgateway
spec:
  profile: empty
  components:
    ingressGateways:
      - name: istio-ingressgateway
        enabled: true
      - name: istio-vpn-ingressgateway
        label:
          app: istio-vpn-ingressgateway
          istio: vpn-ingressgateway
        enabled: true
        k8s:
          serviceAnnotations:
            ...
          service:
            loadBalancerSourceRanges:
              - &quot;x.x.x.x/x&quot;
</code></pre>
<p>Now I want to configure Istio to expose a service outside of the service mesh cluster, using the <a href="https://istio.io/latest/docs/tasks/traffic-management/ingress/kubernetes-ingress/" rel="nofollow noreferrer">Kubernetes Ingress resource</a>. I use the <code>kubernetes.io/ingress.class</code> annotation to tell the Istio gateway controller that it should handle this <code>Ingress</code>.</p>
<pre><code>apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: my-ingress
  annotations:
    kubernetes.io/ingress.class: istio
spec:
   ...
</code></pre>
<ul>
<li>Kubernetes version (EKS): 1.19</li>
<li>Istio version: 1.10.3</li>
</ul>
<p>Which ingress gateway controller is now used (<code>istio-ingressgateway</code> or <code>istio-vpn-ingressgateway</code>)? Is there a way to specify which one should be used?</p>
<p>P.S. I know that I could create a <code>VirtualService</code> and specify the correct gateway but we want to write a manifest that also works without Istio by specifying the correct ingress controller with an annotation.</p>

<p>You can create an ingress class that references the ingress controller that is deployed by default in the istio-system namespace. This configuration with ingress will work, however to my current knowledge, this is only used for backwards compatibility. If you want to use <a href="https://istio.io/latest/docs/tasks/traffic-management/ingress/kubernetes-ingress/" rel="nofollow noreferrer">istio ingress</a> controller functionality, you should use istio gateway and virtual service instead:</p>
<blockquote>
<p>Using the <a href="https://istio.io/latest/docs/tasks/traffic-management/ingress/ingress-control/" rel="nofollow noreferrer">Istio Gateway</a>, rather than Ingress, is recommended to make use of the full feature set that Istio offers, such as rich traffic management and security features.</p>
</blockquote>
<p>If this solution is not optimal for you, you should use e.g. <a href="https://kubernetes.github.io/ingress-nginx/" rel="nofollow noreferrer">nginx ingress controller</a> and you can still bind it with <a href="https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/annotations/" rel="nofollow noreferrer">annotations</a> (deprecated) or using <code>IngressClass</code>. To my present knowledge <strong>it is not possible to bind this ingress class with an additional ingress controller.</strong> If you need an explanation, documentation, you should create an <a href="https://github.com/istio/istio/issues" rel="nofollow noreferrer">issue on github</a>.</p>
<p><strong>Summary:</strong> The recommended option is to use the gateway with virtual service. Another possibility is to use nginx alone ingress with different classes and an ingress resource for them.</p>
