Demo Gateways

In this lesson we will configure an Ingress Gateway for the Bookinfo application using Istio. We’ll:

Verify Istio is installed and sidecar injection is enabled for the default namespace.
Deploy Bookinfo and create an internal VirtualService.
Create a Gateway resource and update the VirtualService to route external traffic.
Test access through the Gateway.
Show how a cloud installation exposes a LoadBalancer for external access.

Verify Istio is installed and the Istio system pods are running:

kubectl get pods -n istio-system

Example output:

NAME                                  READY   STATUS    RESTARTS   AGE
istio-egress-cfcd9bc96-9vlncl         1/1     Running   0          4m32s
istio-ingress-6cf77d4858-g2cvz        1/1     Running   0          4m31s
istiod-5fcb79676-j9vr9                1/1     Running   0          4m42s

Confirm that the default namespace has Istio sidecar injection enabled:

kubectl get ns --show-labels

Example output:

NAME              STATUS    AGE     LABELS
default           Active    5m29s   istio-injection=enabled,kubernetes.io/metadata.name=default
istio-system      Active    4m51s   kubernetes.io/metadata.name=istio-system
kube-node-lease   Active    5m29s   kubernetes.io/metadata.name=kube-node-lease
kube-public       Active    5m29s   kubernetes.io/metadata.name=kube-public
kube-system       Active    5m29s   kubernetes.io/metadata.name=kube-system

Deploy the Bookinfo application (assumed already installed in these steps). Verify Bookinfo pods are running and have two containers (application + sidecar):

kubectl get pods

Example output:

NAME                                 READY   STATUS    RESTARTS   AGE
details-v1-65599dcf88-m7qpm          2/2     Running   0          4s
productpage-v1-9487c9c5b-qq955       2/2     Running   0          4s
ratings-v1-59b99c644-2gdfs           2/2     Running   0          4s
reviews-v1-5985999854-ntzxh          2/2     Running   0          4s
reviews-v2-866dc668-qqgmj            2/2     Running   0          4s
reviews-v3-dbb5fb5db-p78hv           2/2     Running   0          4s

Create an internal VirtualService that routes traffic to the productpage service. Save this as vs.yaml:

apiVersion: networking.istio.io/v1
kind: VirtualService
metadata:
  name: book-info-vs
spec:
  hosts:
    - productpage
  http:
    - match:
        - uri:
            prefix: /
      route:
        - destination:
            host: productpage.default.svc.cluster.local
            port:
              number: 9080

Apply it:

kubectl apply -f vs.yaml
# virtualservice.networking.istio.io/book-info-vs created

At this point the VirtualService works for internal cluster traffic using the host productpage. To expose Bookinfo externally we need a Gateway and then update the VirtualService to reference that Gateway and the external host header. First, identify the label used by the Istio ingress pod so the Gateway selects the correct ingress proxy. Describe the ingress pod (replace the pod name with yours if different):

kubectl describe pod -n istio-system istio-ingress-6cf77d4858-g2cvz

Look at the Labels section. Example labels you may see:

Labels:
  app=istio-ingress
  app.kubernetes.io/name=istio-ingress
  service.istio.io/canonical-name=istio-ingress
  sidecar.istio.io/inject=true

Make sure your Gateway’s selector uses the exact label key/value present on your ingress pods (for example istio=ingress or app=istio-ingress). If the selector doesn’t match, the Gateway will not bind to the ingress proxy.

Create the Gateway in the default namespace (so it pairs with the VirtualService). Save this as gw.yaml:

apiVersion: networking.istio.io/v1
kind: Gateway
metadata:
  name: istio-gateway
spec:
  selector:
    app: istio-ingress
  servers:
    - port:
        number: 80
        name: http
        protocol: HTTP
      hosts:
        - "book.info.com"

Apply the Gateway:

kubectl apply -f gw.yaml
# gateway.networking.istio.io/istio-gateway created

Now update the VirtualService (vs.yaml) so it can be invoked via the external host book.info.com and is bound to the Gateway:

apiVersion: networking.istio.io/v1
kind: VirtualService
metadata:
  name: book-info-vs
spec:
  hosts:
    - "book.info.com"
    - productpage
  gateways:
    - istio-gateway
  http:
    - match:
        - uri:
            prefix: /
      route:
        - destination:
            host: productpage.default.svc.cluster.local
            port:
              number: 9080

Apply the updated VirtualService:

kubectl apply -f vs.yaml
# virtualservice.networking.istio.io/book-info-vs configured

Determine how the ingress is exposed. In some lab environments (kubeadm) Istio’s ingress service is a NodePort; in cloud environments it will usually be a LoadBalancer. Inspect the Istio services:

kubectl get svc -n istio-system

Note: different Istio installs may use slightly different resource names (for example some use istio-ingress while others use istio-ingressgateway). Use the service name you have in your cluster when determining access details. Example (kubeadm lab with NodePort):

NAME            TYPE        CLUSTER-IP      EXTERNAL-IP   PORT(S)
istio-egress    ClusterIP   10.98.33.91     <none>        15021/TCP,80/TCP,443/TCP
istio-ingress   NodePort    10.97.88.127    <none>        15021:38117/TCP,80:30992/TCP,443:30171/TCP
istiod          ClusterIP   10.111.147.170  <none>        15010/TCP,15012/TCP,443/TCP,15014/TCP

Testing the Gateway

From within the cluster or a node that can reach ClusterIP, you can curl the ClusterIP directly and set the Host header to book.info.com.
From outside the cluster when using NodePort, use node-ip:nodePort.
From outside the cluster when using LoadBalancer, use the EXTERNAL-IP (or hostname) provided.

Example curl from a node that can reach the ClusterIP (replace IP with your istio-ingress CLUSTER-IP):

curl --head --header "Host: book.info.com" http://10.97.88.127

If the VirtualService is still only configured for productpage and not the external host, you’ll see a 404 Not Found. After updating the VirtualService to include the host and gateway, retry:

curl --head --header "Host: book.info.com" http://10.97.88.127

Expected response (after configuration):

HTTP/1.1 200 OK
content-type: text/html; charset=utf-8
content-length: 1683
server: istio-envoy
date: Fri, 11 Apr 2025 21:35:57 GMT
x-envoy-upstream-service-time: 21

Once configured correctly, requests whose Host header matches book.info.com will be accepted by the Gateway on port 80 and routed via the VirtualService to the productpage service.

If you are testing from a machine outside the cluster without DNS for book.info.com, pass the Host header with curl (as above) or add a local /etc/hosts entry pointing book.info.com to the load balancer or node IP for convenient testing.

Cloud example: LoadBalancer behavior If Istio is installed on a cloud provider (EKS, AKS, GKE), the istio-ingressgateway service typically becomes a LoadBalancer with an external IP/hostname. Example after installing Istio in a cloud cluster:

kubectl get svc -n istio-system

Example output (LoadBalancer in EKS/AWS):

NAME                    TYPE           CLUSTER-IP      EXTERNAL-IP                                                                 AGE
istio-egressgateway     ClusterIP      10.100.13.95    <none>                                                                      84s
istio-ingressgateway    LoadBalancer   10.100.188.237  ab6be537f8134cc084b21378582fc75-477874693.us-east-1.elb.amazonaws.com   84s
istiod                  ClusterIP      10.100.65.152   <none>                                                                      93s

You can point a DNS record (e.g., book.info.com) to the LoadBalancer’s external hostname/IP and then simply curl http://book.info.com without manually sending the Host header. Summary

Create a VirtualService for the internal service.
Create a Gateway that selects the Istio ingress pod using the correct label.
Update the VirtualService to include the external host and reference the Gateway (via gateways).
Test using the appropriate endpoint (ClusterIP for in-cluster tests, nodeIP:nodePort for NodePort from outside, or external LoadBalancer IP/hostname for cloud installations).

Thank you.

Introduction

Installation & Configuration

Traffic Management

Securing Workloads

Troubleshooting

Conclusion

Watch Video

Practice Lab