The istio-ingressgateway is an Envoy proxy deployed as a Service in an Anthos cluster. It receives traffic bound for cluster Services, inspects the host header, and routes requests to the appropriate Service. section 10.3.2
In hybrid or multicloud environments, it provides the L7 path between clusters when traffic cannot use direct VPC routing. Anthos Service Mesh supplies service discovery and cross-cluster traffic routing around this gateway. section 10.3.2
Deployment implications include:
- Expose the target cluster through an external public load balancer when connecting infrastructure environments across clusters. section 10.3.2
- Provide network access to the Kubernetes API server of every cluster participating in the Anthos Service Mesh. section 10.3.2
- Use a Service Mesh Gateway for Knative traffic routing; Istio is the most popular option, alongside alternatives such as Gloo, Ambassador, Contour, and Kourier. section 9.3
Cross-cluster request path
A request for a Service in a non-GCP Anthos cluster reaches that cluster’s external load balancer, enters the istio-ingressgateway, and is routed by its host header to the appropriate Kubernetes Service. section 10.3.2
Use the multicluster Anthos Service Mesh diagram to relate service discovery, cluster connectivity, and ingress routing. section 10.3.2
