<p>I am having a following working SFTP Deployment in my Kubernetes:</p>
<pre><code>apiVersion: apps/v1
kind: Deployment
metadata:
  name: sftp-deployment
spec:
  replicas: 1
  selector:
    matchLabels:
      app: sftp
  template:
    metadata:
      labels:
        app: sftp
    spec:
      volumes:
      - name: sftp-storage
        persistentVolumeClaim:
          claimName: sftp-pvc
      containers:
      - name: sftp
        image: atmoz/sftp
        ports:
        - containerPort: 22
        env:
        - name: SFTP_USERS
          value: &quot;user1:password:::user-directory&quot;
        volumeMounts:
        - name: ftm-sftp-storage
          mountPath: &quot;/home/user1/user-directory&quot;
        resources:
          requests:
            memory: &quot;64Mi&quot;
            cpu: &quot;250m&quot;
          limits:
            memory: &quot;128Mi&quot;
            cpu: &quot;500m&quot;
</code></pre>
<p>I know that the Deployment is working fine because if I <code>port-forward</code> the deployment I can easily access the directories on port 22 using any FTP Client, like FileZilla.</p>
<p>Of course, what I want to achieve is to expose this deployment to the public using Istio. I have tried to do it by exposing the port 22 in a custom gateway:</p>
<pre><code>apiVersion: networking.istio.io/v1beta1
kind: Gateway
metadata:
  name: sftp-gw
spec:
  selector:
    istio: ingressgateway
  servers:
    - hosts:
        - '*.example.com'
      port:
        name: sftp-gw-server
        number: 22
        protocol: TCP
        targetPort: 22
</code></pre>
<p>And then creating the Virtual Service for it:</p>
<pre><code>apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: sftp-vs
spec:
  gateways:
    - sftp-gw.default.svc.cluster.local
  hosts:
    - my-host.example.com
  tcp:
    - match:
        - port: 22
      route:
        - destination:
            host: sftp-service.default.svc.cluster.local
            port:
              number: 22
</code></pre>
<p>The Service for the Deployment looks as such:</p>
<pre><code>kind: Service
apiVersion: v1
metadata:
  name: sftp-service
spec:
  ports:
    - protocol: TCP
      port: 22
      targetPort: 22
  selector:
    app: sftp-deployment
</code></pre>
<p>This configuration does not work for me.
Does anybody know how to configure properly the Istio to expose the port 22 of the Service/Deployment so it can be accessed via for example FTP Client?
Thanks in advance.</p>

f.bele
<p>Please do below changes in application gateway, virtual service and istio ingress gateway.  As the ports in objects arent matching the requests wont get routed properly.  Below changes are mentioned based on nodeport if LB is used kindly adjust it accordingly.</p>
<p>Gateway:</p>
<pre><code>apiVersion: networking.istio.io/v1beta1
kind: Gateway
metadata:
  name: sftp-gw
spec:
  selector:
    istio: ingressgateway
  servers:
    - hosts:
      - '*.example.com'
      port:
        name: tcp
        number: &lt;mention nodeport number of tcp service ingwservice&gt;
        protocol: TCP
</code></pre>
<p>Virtual Service:</p>
<pre><code>apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: sftp-vs
spec:
  gateways:
    - sftp-gw.default.svc.cluster.local
  hosts:
    - my-host.example.com
  tcp:
    - match:
      - port: &lt;mention nodeport number of tcp service ingwservice&gt;
      route:
      - destination:
          host: sftp-service.default.svc.cluster.local
          port:
            number: 22
</code></pre>
<p>Istio Ingress Gateway Service:
Please declare new tcp service which will be listening for sftp requests. The below information has to match the application gateway definition. Please provide the nodePort, port and targetPort numbers accordingly</p>
<pre><code>- name: tcp
  nodePort: 30009
  port: 30009
  protocol: TCP
  targetPort: 30009
</code></pre>
