Azure
[Feature] enable istio gateway with exsiting azure public ip
Is your feature request related to a problem? Please describe.
the command: az aks mesh enable-ingress-gateway that does not support to enable istio gateway with an exsiting public ip.
This is required for migrating from Istio OSS (already installed) to Istio Addon in our Production clusters, where we don't want to lose the ingress IP, which is whitelisted in upstream system.
![microsoft-github-policy-service[bot] avatar](https://avatars.githubusercontent.com/in/95686?v=4 "Published by a pub.dev verified publisher"){kind=small}
@deuxailes we are working towards supporting Gateway API in the coming months and we are leaning towards keeping that as the UX for configuring the IP address (via the Gateway resource). There are currently some implementation details and edge cases that we still need to work out.
We are looking for the same for internal IP being static. We currently use OSM/Istio with static IP with DNS/wildcard hostname. Is it possible to assign an IP for internal gateway?
@vijaymck our plan is to support ingress related customization (IP address, port, name, namespace, etc) through the Gateway API when we offer support for that. Timelines are still TBD but we are currently working on implementation and design. As of now we do not plan on supporting this for the add-on Istio ingress gateway.
@vijaymck @SatyKrish @deuxailes @npcxiao we have decided to allow customizing the following annotations to the Istio ingress K8s service. This change has now been globally rolled out:
service.beta.kubernetes.io/azure-load-balancer-internal-subnet: to bind an internal ingress gateway to a specific subnet.service.beta.kubernetes.io/azure-shared-securityrule: for exposing the ingress gateway through an augmented security rule.service.beta.kubernetes.io/azure-allowed-service-tags: for specifying which service tags the ingress gateway can receive requests from.service.beta.kubernetes.io/azure-load-balancer-ipv4: for configuring a static IPv4 address.service.beta.kubernetes.io/azure-load-balancer-resource-group: for specifying the resource group of a public IP in a different resource group from the cluster.service.beta.kubernetes.io/azure-pip-name: for specifying the name of a public IP address.
