@cwocwo I see, I did not expect that its removing ports.

there is another way to approach same result which is overlays, that way it does not touch the default configs.

apiVersion: install.istio.io/v1alpha1
kind: IstioOperator
spec:
  components:
    ingressGateways:
      - enabled: true
        k8s:
          overlays: [
            {
              api_version: 'v1',
              kind: 'Service',
              name: 'istio-ingressgateway',
              patches: [
                {
                  path: 'spec.type',
                  value: nodePort
                },
                {
                  path: 'spec.externalIPs',
                  value: ["10.110.22.99"]
                }
              ]
           }
         ]

istioctl manifest generate -f iop.yml | grep externalIPs -B 12 -A 20

---
apiVersion: v1
kind: Service
metadata:
  annotations: null
  labels:
    app: istio-ingressgateway
    istio: ingressgateway
    release: istio
  name: istio-ingressgateway
  namespace: istio-system
spec:
  externalIPs:
  - 10.110.22.99
  ports:
  - name: status-port
    port: 15021
    targetPort: 15021
  - name: http2
    port: 80
    targetPort: 8080
  - name: https
    port: 443
    targetPort: 8443
  - name: tls
    port: 15443
    targetPort: 15443
  selector:
    app: istio-ingressgateway
    istio: ingressgateway
  type: nodePort

---

Not sure which one is best fit in terms of best practices.

@cwocwo can that be the case you are trying to do below

cat iop.yml 

kind: IstioOperator
spec:
  components:
    ingressGateways:
      - enabled: true
        k8s:
          service:
            type: NodePort
            externalIPs: ["10.110.22.99"]

istioctl manifest generate -f iop.yml | grep externalIPs -B 12 -A 7

apiVersion: v1
kind: Service
metadata:
  annotations: null
  labels:
    app: istio-ingressgateway
    istio: ingressgateway
    release: istio
  name: istio-ingressgateway
  namespace: istio-system
spec:
  externalIPs:
  - 10.110.22.99
  ports: null
  selector:
    app: istio-ingressgateway
    istio: ingressgateway
  type: NodePort

@Arnuphap-Yupuech could you please mention how you have added env variable to the deployment at first place? If you have changed directly on deployment it may gone when run istioctl.

You should add env variable same way how you are installing istio. ex: IstioOperator.

https://istio.io/latest/docs/reference/config/istio.operator.v1alpha1/#ComponentSpec https://istio.io/latest/docs/reference/config/istio.operator.v1alpha1/#KubernetesResourcesSpec https://istio.io/latest/docs/reference/config/istio.operator.v1alpha1/#EnvVar

IMO; using one gateway for each different domain/multi level of subdomain should solve problem. And it will help to manage separately incase you gonna apply custom filter for each.

@ECuRyDIN certs are needs to be base64encoded I guess, not decoded when creating secret/tls on Kubernetes (as installation document has examples).

Could you please share steps how you create certs (without sharing your own cert / or creating dummy cert)