<p>I am using an external TCP/UDP network load balancer (Fortigate), Kubernetes 1.20.6 and Istio 1.9.4.
I have set set externalTrafficPolicy: Local and need to run ingress gateway on every node (as said <a href="https://istio.io/latest/docs/tasks/security/authorization/authz-ingress/#source-ip-address-of-the-original-client" rel="nofollow noreferrer">here</a> in network load balancer tab) . How do I do that?</p>
<p>This is my ingress gateway service:</p>
<pre><code>kind: Service
apiVersion: v1
metadata:
  name: istio-ingressgateway
  namespace: istio-system
  uid: d1a86f50-ad14-415f-9c1e-d186fd72cb31
  resourceVersion: '1063961'
  creationTimestamp: '2021-04-28T19:25:37Z'
  labels:
    app: istio-ingressgateway
    install.operator.istio.io/owning-resource: unknown
    install.operator.istio.io/owning-resource-namespace: istio-system
    istio: ingressgateway
    istio.io/rev: default
    operator.istio.io/component: IngressGateways
    operator.istio.io/managed: Reconcile
    operator.istio.io/version: 1.9.4
    release: istio
  annotations:
    kubectl.kubernetes.io/last-applied-configuration: &gt;
      {&quot;apiVersion&quot;:&quot;v1&quot;,&quot;kind&quot;:&quot;Service&quot;,&quot;metadata&quot;:{&quot;annotations&quot;:{},&quot;labels&quot;:{&quot;app&quot;:&quot;istio-ingressgateway&quot;,&quot;install.operator.istio.io/owning-resource&quot;:&quot;unknown&quot;,&quot;install.operator.istio.io/owning-resource-namespace&quot;:&quot;istio-system&quot;,&quot;istio&quot;:&quot;ingressgateway&quot;,&quot;istio.io/rev&quot;:&quot;default&quot;,&quot;operator.istio.io/component&quot;:&quot;IngressGateways&quot;,&quot;operator.istio.io/managed&quot;:&quot;Reconcile&quot;,&quot;operator.istio.io/version&quot;:&quot;1.9.4&quot;,&quot;release&quot;:&quot;istio&quot;},&quot;name&quot;:&quot;istio-ingressgateway&quot;,&quot;namespace&quot;:&quot;istio-system&quot;},&quot;spec&quot;:{&quot;ports&quot;:[{&quot;name&quot;:&quot;status-port&quot;,&quot;port&quot;:15021,&quot;protocol&quot;:&quot;TCP&quot;,&quot;targetPort&quot;:15021},{&quot;name&quot;:&quot;http2&quot;,&quot;port&quot;:80,&quot;protocol&quot;:&quot;TCP&quot;,&quot;targetPort&quot;:8080},{&quot;name&quot;:&quot;https&quot;,&quot;port&quot;:443,&quot;protocol&quot;:&quot;TCP&quot;,&quot;targetPort&quot;:8443},{&quot;name&quot;:&quot;tcp-istiod&quot;,&quot;port&quot;:15012,&quot;protocol&quot;:&quot;TCP&quot;,&quot;targetPort&quot;:15012},{&quot;name&quot;:&quot;tls&quot;,&quot;port&quot;:15443,&quot;protocol&quot;:&quot;TCP&quot;,&quot;targetPort&quot;:15443}],&quot;selector&quot;:{&quot;app&quot;:&quot;istio-ingressgateway&quot;,&quot;istio&quot;:&quot;ingressgateway&quot;},&quot;type&quot;:&quot;LoadBalancer&quot;}}
  managedFields:
    - manager: istio-operator
      ........operation: Apply
      apiVersion: v1
      time: '2021-05-04T18:02:38Z'
      fieldsType: FieldsV1
      fieldsV1:
        'f:metadata':
          'f:annotations':
            'f:kubectl.kubernetes.io/last-applied-configuration': {}
          'f:labels':
            'f:app': {}
            'f:install.operator.istio.io/owning-resource': {}
            'f:install.operator.istio.io/owning-resource-namespace': {}
            'f:istio': {}
            'f:istio.io/rev': {}
            'f:operator.istio.io/component': {}
            'f:operator.istio.io/managed': {}
            'f:operator.istio.io/version': {}
            'f:release': {}
        'f:spec':
          'f:ports':
            'k:{&quot;port&quot;:80,&quot;protocol&quot;:&quot;TCP&quot;}':
              .: {}
              'f:name': {}
              'f:port': {}
              'f:protocol': {}
              'f:targetPort': {}
            'k:{&quot;port&quot;:443,&quot;protocol&quot;:&quot;TCP&quot;}':
              .: {}
              'f:name': {}
              'f:port': {}
              'f:protocol': {}
              'f:targetPort': {}
            'k:{&quot;port&quot;:15012,&quot;protocol&quot;:&quot;TCP&quot;}':
              .: {}
              'f:name': {}
              'f:port': {}
              'f:protocol': {}
              'f:targetPort': {}
            'k:{&quot;port&quot;:15021,&quot;protocol&quot;:&quot;TCP&quot;}':
              .: {}
              'f:name': {}
              'f:port': {}
              'f:protocol': {}
              'f:targetPort': {}
            'k:{&quot;port&quot;:15443,&quot;protocol&quot;:&quot;TCP&quot;}':
              .: {}
              'f:name': {}
              'f:port': {}
              'f:protocol': {}
              'f:targetPort': {}
          'f:selector':
            'f:app': {}
            'f:istio': {}
          'f:type': {}
    - manager: kubectl-patch
      operation: Update
      apiVersion: v1
      time: '2021-05-04T18:01:23Z'
      fieldsType: FieldsV1
      fieldsV1:
        'f:spec':
          'f:externalIPs': {}
          'f:externalTrafficPolicy': {}
          'f:type': {}
  selfLink: /api/v1/namespaces/istio-system/services/istio-ingressgateway
spec:
  ports:
    - name: status-port
      protocol: TCP
      port: 15021
      targetPort: 15021
      nodePort: 30036
    - name: http2
      protocol: TCP
      port: 80
      targetPort: 8080
      nodePort: 32415
    - name: https
      protocol: TCP
      port: 443
      targetPort: 8443
      nodePort: 32418
    - name: tcp-istiod
      protocol: TCP
      port: 15012
      targetPort: 15012
      nodePort: 31529
    - name: tls
      protocol: TCP
      port: 15443
      targetPort: 15443
      nodePort: 30478
  selector:
    app: istio-ingressgateway
    istio: ingressgateway
  clusterIP: 10.103.72.212
  clusterIPs:
    - 10.103.72.212
  type: LoadBalancer
  externalIPs:
    - 10.43.34.38
    - 10.43.34.77
  sessionAffinity: None
  externalTrafficPolicy: Local
  healthCheckNodePort: 30788
status:
  loadBalancer: {}
</code></pre>
<p>The firewall has these two addresses 10.43.34.38 and 10.43.34.77, and relays requests to two K8S nodes on ports 32415 (http) and 32415 (https).</p>

brgsousa
<p>As brgsousa mentioned in the comment, the solution was redeploy as DaemonSet.</p>
<p>Here is working yaml file:</p>
<pre><code>apiVersion: install.istio.io/v1alpha1
kind: IstioOperator
spec:
  meshConfig:
    accessLogFile: /dev/stdout
  components:
    ingressGateways:
    - name: istio-ingressgateway
      enabled: true
      k8s:
        overlays:
        - apiVersion: apps/v1
          kind: Deployment
          name: istio-ingressgateway
          patches:
          - path: kind
            value: DaemonSet
          - path: spec.strategy
          - path: spec.updateStrategy
            value:
              rollingUpdate:
                maxUnavailable: 50%
              type: RollingUpdate
    egressGateways:
    - name: istio-egressgateway
      enabled: true
</code></pre>
