<p>I am trying to understand the Istio traffic routing.  I installed Istio in demo mode and got to playing around with the samples.  The samples have you install a few gateways (I did <code>bookinfo-gateway</code> and <code>httpbin-gateway</code>.</p>
<p>But it seems all my traffic goes through the &quot;http2&quot; port defined in <code>istio-ingressgateway</code> in the <code>istio-system</code> namespace.</p>
<p><a href="https://istio.io/latest/docs/concepts/traffic-management/" rel="nofollow noreferrer">The documentation</a> makes reference to this:</p>
<blockquote>
<p>Istio provides some preconfigured gateway proxy deployments (istio-ingressgateway and istio-egressgateway) that you can use - both are deployed if you use our demo installation</p>
</blockquote>
<p>But when I run: <code>kubectl -n istio-system get service istio-ingressgateway -o yaml</code> the result shows <code>kind: Service</code>.</p>
<p>The other gateways the demos had me made show <code>kind: Gateway</code>.</p>
<p>So I am left confused...</p>
<ol>
<li>Is there a difference between a service and a gateway?</li>
<li>How would I use the sample application gateways instead of the <code>istio-ingressgateway</code> (that is really a service).</li>
<li>How does istio connect my <code>VirtualService</code> to the <code>istio-ingressgateway</code>.  Is it just looking for all <code>VirtualServices</code>?</li>
</ol>

<blockquote>
<p>Is there a difference between a service and a gateway?</p>
</blockquote>
<p>Yes.</p>
<ul>
<li>The <code>istio-ingressgateway</code> is a kubernetes service of type <code>LoadBalancer</code> (or <code>NodePort</code>, depending on your setup) that serves as the entry point into your cluster. The ingressgateway is the ingress controller of istio and it is completely optional.</li>
<li>The <code>gateway</code> is a custom resource of istio, that serves as an entry into your mesh. It is bound to an ingressgateway by the selector, eg see <a href="https://github.com/istio/istio/blob/master/samples/httpbin/httpbin-gateway.yaml" rel="noreferrer">https://github.com/istio/istio/blob/master/samples/httpbin/httpbin-gateway.yaml</a></li>
</ul>
<pre><code>kind: Gateway
[...]
spec:
  selector:
    istio: ingressgateway
</code></pre>
<blockquote>
<p>How would I use the sample application gateways instead of the istio-ingressgateway (that is really a service).</p>
</blockquote>
<p>You need both (or another form of ingress controller and route all traffic through the mesh gateway, more on that see below).</p>
<blockquote>
<p>How does istio connect my VirtualService to the istio-ingressgateway. Is it just looking for all VirtualServices?</p>
</blockquote>
<p>See this yaml file again: <a href="https://github.com/istio/istio/blob/master/samples/httpbin/httpbin-gateway.yaml" rel="noreferrer">https://github.com/istio/istio/blob/master/samples/httpbin/httpbin-gateway.yaml</a></p>
<p>The gateway is bound to the ingressgateway.</p>
<pre><code>apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: httpbin-gateway
spec:
  selector:
    istio: ingressgateway
[...]
</code></pre>
<p>A <code>VirtualService</code> like the one in the file is bound to a <code>gateway</code>.</p>
<pre><code>apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: httpbin
spec:
  gateways:
  - httpbin-gateway
[...]
</code></pre>
<p>So if the traffic uses your gateway the <code>VirtualService</code> is considered.</p>
<p>Beside the gateways you configure, there is always the mesh gateway. So if you want your internal cluster traffic to use the istio configuration, you need to either add the mesh gateway to your virutal service:</p>
<pre><code>  gateways:
  - httpbin-gateway
  - mesh
</code></pre>
<p>or create a separat virutal service for that. If you don't set any gateway, mesh gateway will be used, since it is the default.
See: <a href="https://istio.io/latest/docs/reference/config/networking/virtual-service/#VirtualService" rel="noreferrer">https://istio.io/latest/docs/reference/config/networking/virtual-service/#VirtualService</a> -&gt; the gateways entry</p>
