// Module included in the following assemblies:
//
// * service_mesh/v1x/ossm-traffic-manage.adoc
// * service_mesh/v2x/ossm-traffic-manage.adoc

:_mod-docs-content-type: PROCEDURE
[id="ossm-routing-ingress_{context}"]
= Managing ingress traffic

In {SMProductName}, the Ingress Gateway enables features such as monitoring, security, and route rules to apply to traffic that enters the cluster. Use a {SMProductShortName} gateway to expose a service outside of the service mesh.

[id="ossm-routing-determine-ingress_{context}"]
== Determining the ingress IP and ports

Ingress configuration differs depending on if your environment supports an external load balancer. An external load balancer is set in the ingress IP and ports for the cluster. To determine if your cluster's IP and ports are configured for external load balancers, run the following command. In this example, `istio-system` is the name of the {SMProductShortName} control plane project.

[source,terminal]
----
$ oc get svc istio-ingressgateway -n istio-system
----

That command returns the `NAME`, `TYPE`, `CLUSTER-IP`, `EXTERNAL-IP`, `PORT(S)`, and `AGE` of each item in your namespace.

If the `EXTERNAL-IP` value is set, your environment has an external load balancer that you can use for the ingress gateway.

If the `EXTERNAL-IP` value is `<none>`, or perpetually `<pending>`, your environment does not provide an external load balancer for the ingress gateway.

////
TO DO - remove XREF in this module.
Determine the ingress according to your environment. For an environment with load balancer support, xref:../../service_mesh/v2x/ossm-traffic-manage.adoc#ossm-routing-config-ig-lb_routing-traffic[Determining ingress ports with a load balancer]. For an environment without load balancer support, xref:../../service_mesh/v2x/ossm-traffic-manage.adoc#ossm-routing-config-ig-no-lb_routing-traffic[Determining ingress ports without a load balancer]. After you have determined the ingress ports, see xref:../../service_mesh/v2x/ossm-traffic-manage.adoc#ossm-routing-gateways_routing-traffic[Configuring ingress using a gateway] to complete your configuration.
////

[id="ossm-routing-config-ig-lb_{context}"]
=== Determining ingress ports with a load balancer

Follow these instructions if your environment has an external load balancer.

.Procedure

. Run the following command to set the ingress IP and ports. This command sets a variable in your terminal.
+
[source,terminal]
----
$ export INGRESS_HOST=$(oc -n istio-system get service istio-ingressgateway -o jsonpath='{.status.loadBalancer.ingress[0].ip}')
----

. Run the following command to set the ingress port.
+
[source,terminal]
----
$ export INGRESS_PORT=$(oc -n istio-system get service istio-ingressgateway -o jsonpath='{.spec.ports[?(@.name=="http2")].port}')
----

. Run the following command to set the secure ingress port.
+
[source,terminal]
----
$ export SECURE_INGRESS_PORT=$(oc -n istio-system get service istio-ingressgateway -o jsonpath='{.spec.ports[?(@.name=="https")].port}')
----

. Run the following command to set the TCP ingress port.
+
[source,terminal]
----
$ export TCP_INGRESS_PORT=$(kubectl -n istio-system get service istio-ingressgateway -o jsonpath='{.spec.ports[?(@.name=="tcp")].port}')
----

[NOTE]
====
In some environments, the load balancer may be exposed using a hostname instead of an IP address. For that case, the ingress gateway's `EXTERNAL-IP` value is not an IP address. Instead, it is a hostname, and the previous command fails to set the `INGRESS_HOST` environment variable.

In that case, use the following command to correct the `INGRESS_HOST` value:
====

[source,terminal]
----
$ export INGRESS_HOST=$(oc -n istio-system get service istio-ingressgateway -o jsonpath='{.status.loadBalancer.ingress[0].hostname}')
----

[id="ossm-routing-config-ig-no-lb_{context}"]
=== Determining ingress ports without a load balancer

If your environment does not have an external load balancer, determine the ingress ports and use a node port instead.

.Procedure

. Set the ingress ports.
+
[source,terminal]
----
$ export INGRESS_PORT=$(oc -n istio-system get service istio-ingressgateway -o jsonpath='{.spec.ports[?(@.name=="http2")].nodePort}')
----

. Run the following command to set the secure ingress port.
+
[source,terminal]
----
$ export SECURE_INGRESS_PORT=$(oc -n istio-system get service istio-ingressgateway -o jsonpath='{.spec.ports[?(@.name=="https")].nodePort}')
----

. Run the following command to set the TCP ingress port.
+
[source,terminal]
----
$ export TCP_INGRESS_PORT=$(kubectl -n istio-system get service istio-ingressgateway -o jsonpath='{.spec.ports[?(@.name=="tcp")].nodePort}')
----
