<p>I had an existing instance of <a href="https://istio.io/v1.5/docs/reference/config/istio.operator.v1alpha1/" rel="nofollow noreferrer">IstioOperator</a> installed from Istio v1.5:</p>

<pre class="lang-yaml prettyprint-override"><code>apiVersion: install.istio.io/v1alpha1
kind: IstioOperator
metadata:
  namespace: istio-system
  name: istio
spec:
  profile: default
  components:
    ingressGateways:
      - namespace: istio-system
        name: istio-ingressgateway
        enabled: true
        k8s:
          serviceAnnotations:
            "cloud.google.com/load-balancer-type": "Internal"
            "service.beta.kubernetes.io/aws-load-balancer-internal": "0.0.0.0/0"
            "service.beta.kubernetes.io/azure-load-balancer-internal": "true"
            "external-dns.alpha.kubernetes.io/hostname": "*.SedTarget"
  addonComponents:
    kiali:
      enabled: true
    prometheus:
      enabled: false
</code></pre>

<p>This worked fine.</p>

<p>I added the following section in the <code>k8s</code> section (under <code>spec.components.ingressGateways[0].k8s</code>):</p>

<pre class="lang-yaml prettyprint-override"><code>          overlays:
          - apiVersion: v1
            kind: Service
            name: istio-ingressgateway
            patches:
            - path: spec.ports.[name:kafka]
              value:
                name: kafka
                protocol: TCP
                port: 9092
                targetPort: 9092
</code></pre>

<p>So that I could add <code>kafka</code> to list of ports.</p>

<p>This did not work, even though <a href="https://istio.io/v1.5/docs/reference/config/istio.operator.v1alpha1/#K8sObjectOverlay-PathValue" rel="nofollow noreferrer">the docs show I should be able to specify something like <code>[name:kafka]</code> to add an element to a list</a>:</p>

<blockquote>
  <h3>K8sObjectOverlay.PathValue</h3>
  
  <p>Field - Path of the form <code>a.[key1:value1].b.[:value2]</code> Where <code>[key1:value1]</code> is a selector for a key-value pair to identify a list element and <code>[:value]</code> is a value selector to identify a list element in a leaf list. All path intermediate nodes must exist.</p>
</blockquote>

<p><strong>I believe this is not due to a typo, because I <em>am</em> able to replace an existing element in the list with the <code>kafka</code> patch by specifying a path like <code>spec.ports[1]</code></strong>. I am not able to specify an existing port to overwrite it with any <code>[key:value]</code> pair, and <code>spec.ports[-]</code> does not work for appending to the end of the list.</p>

<p>This does not match my expectations. Does anyone have any ideas where I'm going wrong?</p>

<p>Thanks in advance!</p>

jeremysprofile
<p>I spent some time learning this and got the <code>tls</code> service to work. </p>

<p>First, sounds like you are missing the <code>|</code> in the YAML override.</p>

<pre class="lang-yaml prettyprint-override"><code>          overlays:
          - apiVersion: v1
            kind: Service
            name: istio-ingressgateway
            patches:
            - path: spec.ports.[name:kafka]
              value: |  &lt;== here
                name: kafka
                protocol: TCP
                port: 9092
                targetPort: 9092
</code></pre>

<p>You can get more info by looking at the operator logs. For example:</p>

<pre><code>$ kubectl -n istio-operator logs istio-operator-5998f6c744-kg2v6
</code></pre>

<p>and you should see something like this:</p>

<pre><code>2020-06-20T06:20:28.200545Z info    installer   Applying Kubernetes overlay:
- kind: Service
  name: istio-ingressgateway
  patches:
  - path: spec.ports.[name:kafka]
    value: |
      name: kafka
      port: 9092
      protocol: TCP
      targetPort: 9092
</code></pre>

<p>However, this doesn't seem to override the port and I get (even if I manually add the kafka port to the <code>istio-ingressgateway</code> K8s service):</p>

<pre><code>2020-06-20T06:37:01.388907Z error   reconciling err: path spec.ports.[name:kafka]: element [name:kafka] not found
</code></pre>

<p>It does work with something existing like <code>spec.ports.[name:tls]</code>. </p>

<p>Now, I'm not exactly sure what you are trying to do by modifying the ingress gateway service. As I understand these overrides are meant for specific Istio components and not how you 'use' Istio per se.</p>

<p>Typically, to add a gateway/service with Istio you would use something like <a href="https://istio.io/latest/docs/tasks/traffic-management/ingress/ingress-control/#configuring-ingress-using-an-istio-gateway" rel="nofollow noreferrer">this</a> with <code>Gateway</code> and <code>VirtualService</code> resources.</p>
