<p>In a multi cluster, single mesh with namespace tenancy setup with Istio (purely to have over 5,000 nodes), I would like to create a gateway and assign it to specific nodes, the current docs does not cover this for a gateway <a href="https://istio.io/latest/docs/reference/config/networking/gateway/" rel="nofollow noreferrer">here</a> however the IstioOperator does <a href="https://istio.io/latest/docs/reference/config/istio.operator.v1alpha1/#KubernetesResourcesSpec" rel="nofollow noreferrer">here</a> via NodeSelector</p>
<p>How would I go about assigning specific nodes (and where possible specific public IPs for the Istio Gateway)</p>
<p>I have looked into a <a href="https://stackoverflow.com/questions/67373027/istio-run-ingress-gateway-on-every-node">similar question</a>, however I do not see any proper documented approach to this issue.</p>
<p><strong>EDIT</strong> I would like the Gateway to be the sole ingress for all namespaces on the cluster</p>

itsezc
<p><code>Gateway</code> object is no more than <code>Envoy</code> config for <code>istio-ingressgateway</code> pod which is an <code>Envoy</code> proxy.</p>
<p>So, if you want your gateway to be deployed on a specific node, you should add the <code>nodeSelector</code> or <code>nodeAffinity</code> to the <code>Deployment</code> object of <code>istio-ingressgateway</code>.</p>
<p><strong>EDIT</strong></p>
<p>Assuming you have <code>istioctl</code> downloaded.</p>
<pre><code>$ kubectl label no worker-1-v1-21 istio-gatewaynode=valid
$ istioctl manifest generate --set profile=demo &gt; istio.yaml
$ vim istio.yaml
</code></pre>
<p>Search for the <code>Deployment</code> called <code>istio-ingressgateway</code>, and add teh following lines to <code>nodeAffinity</code> sectio as follows:</p>
<pre><code>      ...
      requiredDuringSchedulingIgnoredDuringExecution:
        nodeSelectorTerms:
        - matchExpressions:
          - key: kubernetes.io/arch
            operator: In
            values:
            - amd64
            - ppc64le
            - s390x
      requiredDuringSchedulingIgnoredDuringExecution: &lt;-
        nodeSelectorTerms:                            &lt;- 
        - matchExpressions:                           &lt;- add
          - key: istio-gatewaynode                    &lt;- these
            operator: In                              &lt;- lines
            values:                                   &lt;-
            - valid                                   &lt;-
  containers:
  - args:
  ... 
</code></pre>
<p>Install istio with the generated yaml:</p>
<pre><code># kubectl create -f istio.yaml
...
# kubectl get po -n istio-system -owide
NAME                                    READY   STATUS    RESTARTS   AGE   IP               NODE             NOMINATED NODE   READINESS GATES
istio-egressgateway-5547fcc8fc-wntbc    1/1     Running   0          13m   192.168.184.5    worker-2-v1-21   &lt;none&gt;           &lt;none&gt;
istio-ingressgateway-85b7fddd86-mntmz   1/1     Running   0          13m   192.168.166.70   worker-1-v1-21   &lt;none&gt;           &lt;none&gt;
istiod-6659979bdf-vwc4x                 1/1     Running   0          13m   192.168.184.4    worker-2-v1-21   &lt;none&gt;           &lt;none&gt;
</code></pre>
