<p>My question is related or kinda the same as <a href="https://stackoverflow.com/questions/67680232/how-are-the-various-istio-ports-used">How are the various Istio Ports used?</a>, but I will try to simplify it.</p>
<p>Consider that I have the following istio operator config:</p>
<pre><code>apiVersion: install.istio.io/v1alpha1
kind: IstioOperator
...
spec:
...
  components:
...
    ingressGateways:
...
service:
          - port: 80
            targetPort: 8080
            nodePort: 30080 
            name: http2
            protocol: TCP
</code></pre>
<p>And I have an ingress already forward the traffic to the port 80.</p>
<p>My question is about the target port here, so the request will go through the ingress on, e.g port 80, it will go through the node nodePort, the port, then the targetPort 8080 where it will land on Istio Proxy for ingress controller.</p>
<p>The right configurations for gateway to mesh this request will be 80 not 8080, something like:</p>
<pre><code>apiVersion: networking.istio.io/v1beta1
kind: Gateway
---
spec: 
  selector:
    istio: ingressgateway
  servers:
  - port:
      number: 80
</code></pre>
<p>The question is, given that the ingressgateway receives the traffic on port 8080, how it figures out the used service port was originally 80? Note that this example works fine without any issue.</p>
<p>Is it like the proxy queries kube-api about what's the service port for the port number I receive the request on on based on that will decide which Gateway this request belongs to?</p>

Aladdin
<p>In my <a href="https://stackoverflow.com/questions/67680232/how-are-the-various-istio-ports-used/74161456#74161456">answer</a> to the question you mentioned, I described how kubernetes takes the <code>k8s.service</code> definition to setup routing in the cluster.</p>
<p>You're question focuses more on the istio part, so let's got deeper on that part here, but you might want to read the other answer first.</p>
<p>So you send a request to port <code>80</code>, which is internally routed to the ingressgateway port on port <code>8080</code>. But the request is still &quot;for port 80&quot;, so you need to configure the ingressgateway application to listen on that port.</p>
<p>After installing istio on a vanilla minikube you can get the initial config of the ingressgateway pod by running <code>istioctl pc all pod/istio-ingressgateway-&lt;randomstring&gt;.istio-system -o json &gt; /tmp/init</code>, saving it for later.</p>
<p>Now add a simple <code>Gateway</code> like</p>
<pre><code>$ kubectl apply -f - &lt;&lt;EOF
apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: gateway
  namespace: default
spec:
  selector:
    istio: ingressgateway
  servers:
  - port:
      number: 80
      name: http
      protocol: HTTP
    hosts:
    - &quot;nginx.example.com&quot;
EOF
</code></pre>
<p>Get the config again <code>stioctl pc all pod/istio-ingressgateway-&lt;randomstring&gt;.istio-system -o json &gt; /tmp/with-gw</code> and compare it with the <code>/tmp/init</code> file.</p>
<p>You'll see that a listener was created with the address that has the <code>port_value</code> 8080 and the default <code>filter_chains</code> (which I removed because it's quite long) and also a &quot;blackhole&quot; route:</p>
<pre><code>+      dynamic_listeners: [
+        {
+          name: &quot;0.0.0.0_8080&quot;
+          active_state: {
+            listener: {
+              @type: &quot;type.googleapis.com/envoy.config.listener.v3.Listener&quot;
+              name: &quot;0.0.0.0_8080&quot;
+              address: {
+                socket_address: {
+                  address: &quot;0.0.0.0&quot;
+                  port_value: 8080
+                }
+              }
[...]
+      dynamic_route_configs: [
+        {
+          route_config: {
+            @type: &quot;type.googleapis.com/envoy.config.route.v3.RouteConfiguration&quot;
+            name: &quot;http.8080&quot;
+            virtual_hosts: [
+              {
+                name: &quot;blackhole:80&quot;
+                domains: [
+                  &quot;*&quot;
+                ]
+              }
+            ]
+            validate_clusters: false
+          }
+        }
+      ]
</code></pre>
<p>Now add a <code>VirtualService</code> with some simple config like:</p>
<pre><code>$ kubectl apply -f - &lt;&lt;EOF
apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: vs-nginx
  namespace: default
spec:
  gateways:
  - gateway
  hosts:
  - &quot;nginx.example.com&quot;
  http:
  - match:
    - uri:
        prefix: /
    headers:
      response:
        add:
          My-Custom-Header1: &quot;abc-123&quot;
    route:
    - destination:
        port:
          number: 8080
        host: nginx-test.default.svc.cluster.local
EOF
</code></pre>
<p>get the config <code>istioctl pc all pod/istio-ingressgateway-&lt;randomstring&gt;.istio-system -o json &gt; /tmp/with-vs</code> and diff it again with the <code>/tmp/with-gw</code> file.
Now the <code>route_config</code> changed with an added route to <code>nginx-test.default.svc.cluster.local</code> (the fqdn of my nginx application running in the default namespace), the instructions to add the header, the retry policy and the added domain <code>nginx.example.com</code>.</p>
<pre><code>           route_config: {
             virtual_hosts: [
               {
+                routes: [
+                  {
+                    match: {
+                      prefix: &quot;/&quot;
+                      case_sensitive: true
+                    }
+                    route: {
+                      cluster: &quot;outbound|8080||nginx-test.default.svc.cluster.local&quot;
+                      timeout: &quot;0s&quot;
+                      retry_policy: {
+                        retry_on: &quot;connect-failure,refused-stream,unavailable,cancelled,retriable-status-codes&quot;
+                        num_retries: 2
+                        retry_host_predicate: [
+                          {
+                            name: &quot;envoy.retry_host_predicates.previous_hosts&quot;
+                          }
+                        ]
+                        host_selection_retry_max_attempts: &quot;5&quot;
+                        retriable_status_codes: [
+                          503
+                        ]
+                      }
+                      max_stream_duration: {
+                        max_stream_duration: &quot;0s&quot;
+                        grpc_timeout_header_max: &quot;0s&quot;
+                      }
+                    }
+                    metadata: {
+                      filter_metadata: {
+                        istio: {
+                          config: &quot;/apis/networking.istio.io/v1alpha3/namespaces/default/virtual-service/vs-nginx&quot;
+                        }
+                      }
+                    }
+                    decorator: {
+                      operation: &quot;nginx-test.default.svc.cluster.local:8080/*&quot;
+                    }
+                    response_headers_to_add: [
+                      {
+                        header: {
+                          key: &quot;My-Custom-Header1&quot;
+                          value: &quot;abc-123&quot;
+                        }
+                        append: true
+                      }
+                    ]
+                  }
+                ]
+                include_request_attempt_count: true
-                name: &quot;blackhole:80&quot;
+                name: &quot;nginx.example.com:80&quot;
                 domains: [
-                  &quot;*&quot;
+                  &quot;nginx.example.com&quot;
+                  &quot;nginx.example.com:*&quot;
                 ]
               }
             ]
           }
         }
       ]
     }
</code></pre>
<p>For more on the how to debug envoy config check out this <a href="https://www.youtube.com/watch?v=OQFFIXFeZns" rel="nofollow noreferrer">youtube session</a> by solo.io.</p>
