<p>Sorry in advance if my terminology isn't perfect, I'm learning Kubernetes right now.</p>

<p>I have a self-managed Kubernetes cluster on a series of AWS instances, with one master node and five worker nodes. All nodes are running Ubuntu 18.04. These nodes are all on a VPC and I ssh into them using a bastion host. For the time being, I've also given all of the nodes external IPs as well, just to make testing easier. I also have a domain, let's call it xxx.example.org, pointed at the current external IP of the master node.</p>

<p>I set up Kubernetes using Kubespray and then proceeded to install Istio (using istioctl) and set up the Ingress Gateway per the official docs <a href="https://istio.io/docs/setup/getting-started/" rel="nofollow noreferrer">here</a> and <a href="https://istio.io/docs/tasks/traffic-management/ingress/ingress-control/" rel="nofollow noreferrer">here</a></p>

<p>When I run <code>kubectl get svc -n istio-system istio-ingressgateway</code>, the External-IP for the cluster is always :</p>

<pre><code>NAME                   TYPE           CLUSTER-IP     EXTERNAL-IP   PORT(S)                                                                                                                                      AGE
istio-ingressgateway   LoadBalancer   10.233.3.209   &lt;pending&gt;     15020:30051/TCP,80:32231/TCP,443:30399/TCP,15029:31406/TCP,15030:32078/TCP,15031:30050/TCP,15032:30204/TCP,31400:31912/TCP,15443:31071/TCP   3m1s
</code></pre>

<p>I am able to access the services in a browser using <code>IP:32231/headers</code> or <code>xxx.example.org:32231/headers</code></p>

<p>I used the following command to configure my Gateway and VirtualService for the httpbin and Bookinfo projects referenced in the Istio docs:</p>

<pre><code>kubectl apply -f - &lt;&lt;EOF
apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: httpbin-gateway
spec:
  selector:
    istio: ingressgateway # use Istio default gateway implementation
  servers:
  - port:
      number: 80
      name: http
      protocol: HTTP
    hosts:
    - "*"
---
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: httpbin
spec:
  hosts:
  - "*"
  gateways:
  - httpbin-gateway
  http:
  - match:
    - uri:
        prefix: /status
    - uri:
        prefix: /delay
    - uri:
        prefix: /headers
    route:
    - destination:
        port:
          number: 8000
        host: httpbin
  - match:
    - uri:
        exact: /productpage
    - uri:
        prefix: /static
    - uri:
        exact: /login
    - uri:
        exact: /logout
    - uri:
        prefix: /api/v1/products
    route:
    - destination:
        host: productpage
        port:
          number: 9080
EOF
</code></pre>

<p>Seeing as this is a self-managed cluster, is there any way to get an external-ip for the cluster? If not, how would I go about modifying my current configuration such that the pages are accessible from <code>xxx.example.org</code> rather than <code>xxx.example.org:32231</code>? </p>

<p><strong>EDIT #1</strong></p>

<p>I did try to set up a NLB on AWS by following <a href="https://istio.io/blog/2018/aws-nlb/" rel="nofollow noreferrer">this documentation</a> and <a href="https://medium.com/swlh/public-and-private-istio-ingress-gateways-on-aws-f968783d62fe" rel="nofollow noreferrer">this guide</a>. Unfortunately, this didn't change anything, the <code>EXTERNAL-IP</code> is still <code>&lt;pending&gt;</code>. After doing that, I deployed a new ingress gateway, which looked like this:</p>

<pre><code>apiVersion: v1
kind: Service
metadata:
  annotations:
    service.beta.kubernetes.io/aws-load-balancer-type: "nlb"
  labels:
    app: istio-ingressgateway-2
    istio: ingressgateway-2
    operator.istio.io/component: IngressGateways
    operator.istio.io/managed: Reconcile
    operator.istio.io/version: 1.5.2
    release: istio
  name: istio-ingressgateway-2
  namespace: istio-system
spec:
  ports:
  - name: status-port
    nodePort: 30625
    port: 15020
    protocol: TCP
    targetPort: 15020
  - name: http2
    nodePort: 32491
    port: 80
    protocol: TCP
    targetPort: 80
  - name: https
    nodePort: 30466
    port: 443
    protocol: TCP
    targetPort: 443
  - name: kiali
    nodePort: 32034
    port: 15029
    protocol: TCP
    targetPort: 15029
  - name: prometheus
    nodePort: 30463
    port: 15030
    protocol: TCP
    targetPort: 15030
  - name: grafana
    nodePort: 31176
    port: 15031
    protocol: TCP
    targetPort: 15031
  - name: tracing
    nodePort: 32040
    port: 15032
    protocol: TCP
    targetPort: 15032
  - name: tcp
    nodePort: 32412
    port: 31400
    protocol: TCP
    targetPort: 31400
  - name: tls
    nodePort: 30411
    port: 15443
    protocol: TCP
    targetPort: 15443
  selector:
    app: istio-ingressgateway-2
    istio: ingressgateway-2
  type: LoadBalancer
</code></pre>

<p>I also changed my <code>httpbin-gateway</code> to use <code>ingressgateway-2</code>. This failed to load anything, even on port 32231.</p>

Vivek Ramachandran
<p>This issue can be fixed by adding annotations to Your <code>LoadBalancer</code> service manifest.</p>
<p>According to <a href="https://docs.aws.amazon.com/eks/latest/userguide/load-balancing.html" rel="nofollow noreferrer">Amazon</a> Documentation:</p>
<blockquote>
<p>Amazon EKS supports the Network Load Balancer and the Classic Load Balancer for pods running on Amazon EC2 instance worker nodes through the Kubernetes service of type  <code>LoadBalancer</code>. Classic Load Balancers and Network Load Balancers are not supported for pods running on AWS Fargate (Fargate). For Fargate ingress, we recommend that you use the  <a href="https://docs.aws.amazon.com/eks/latest/userguide/alb-ingress.html" rel="nofollow noreferrer">ALB Ingress Controller</a>  on Amazon EKS (minimum version v1.1.4).</p>
<p>The configuration of your load balancer is controlled by annotations that are added to the manifest for your service. By default, Classic Load Balancers are used for  <code>LoadBalancer</code>  type services. To use the Network Load Balancer instead, apply the following annotation to your service:</p>
<p><code>service.beta.kubernetes.io/aws-load-balancer-type: nlb</code></p>
<p>For an example service manifest that specifies a load balancer, see  <a href="https://kubernetes.io/docs/concepts/services-networking/service/#loadbalancer" rel="nofollow noreferrer">Type LoadBalancer</a>  in the Kubernetes documentation. For more information about using Network Load Balancer with Kubernetes, see  <a href="https://kubernetes.io/docs/concepts/services-networking/service/#aws-nlb-support" rel="nofollow noreferrer">Network Load Balancer support on AWS</a>  in the Kubernetes documentation.</p>
<p>By default, services of type  <code>LoadBalancer</code>  create public-facing load balancers. To use an internal load balancer, apply the following annotation to your service:</p>
<p><code>service.beta.kubernetes.io/aws-load-balancer-internal: &quot;true&quot;</code></p>
<p>For internal load balancers, your Amazon EKS cluster must be configured to use at least one private subnet in your VPC. Kubernetes examines the route table for your subnets to identify whether they are public or private. Public subnets have a route directly to the internet using an internet gateway, but private subnets do not.</p>
</blockquote>
<p>To add one or more annotations like that to Your istio ingress configuration You can follow an example from <a href="https://medium.com/swlh/public-and-private-istio-ingress-gateways-on-aws-f968783d62fe" rel="nofollow noreferrer">this</a> article.</p>
<p>Hope it helps.</p>
