Because TCP traffic is directly forwarded to the destination, the destination must be capable of handling incoming TLS traffic.

Figure: TCP listener setup

Before you begin

Set up Gloo Mesh Gateway in a single cluster. You do not need to deploy sample apps or set up routing, as you create the TCP helloworld sample app as part of this example.

Open the TCP port on the ingress gateway

When you followed the get started guide, the ingress gateway is set up without a TCP port. To configure a TCP listener on your gateway, you must first open up a TCP port on the ingress gateway.

  1. Get the details of the ingress gateway service and check if port 9000 with the name tcp is open on your ingress gateway.

      kubectl get service istio-ingressgateway -n gloo-mesh-gateways -o yaml

    Example output if the TCP port is open on the gateway:

      - name: tcp
        nodePort: 30358
        port: 9000
        protocol: TCP
        targetPort: 9000
  2. If the port is not yet open on your ingress gateway, perform an upgrade of your Istio ingress gateway to open up the TCP port. The upgrade steps vary based on your gateway installation method.

  3. After the upgrade, verify that the TCP port is now open on your ingress gateway.

      kubectl get service istio-ingressgateway -n gloo-mesh-gateways -o yaml

Deploy the helloworld TCP sample app

The helloworld sample app is a simple way to test responses for different app versions. The following examples install four versions of helloworld in your cluster.

  1. Create a helloworld namespace.

      kubectl create ns helloworld
  2. Deploy helloworld v1, v2, v3, and v4 to your cluster.

      kubectl -n helloworld apply -f 
  3. Verify that the helloworld apps are running.

      kubectl -n helloworld get pods

Set up a TCP listener on your gateway

To route TCP traffic to the TCP app directly without originating a TLS connection at the gateway, you create a virtual gateway and configure a TCP listener.

  1. Create the virtual gateway and configure your TCP listener. Note that the tcp section of your virtual gateway config must remain empty so that the gateway is instructed to directly forward the traffic to the TCP workload in the cluster.

      kubectl apply -f- <<EOF
    kind: VirtualGateway
      annotations: ""
      name: istio-ingressgateway-tcp
      namespace: helloworld
      - port:
          number: 9000
        tcp: {}
      - selector:
            istio: ingressgateway
  2. Create a route table to route incoming requests on any host to the helloworld TCP app that you created.

      kubectl apply -f- <<EOF
    kind: RouteTable
      annotations: ""
      name: tcp-route
      namespace: helloworld
      - '*'
      - forwardTo:
          - port:
              number: 9000
              cluster: $CLUSTER_NAME
              name: helloworld
              namespace: helloworld
        - port: 9000
      - name: istio-ingressgateway-tcp
  3. Get the IP address of your ingress gateway.

      export INGRESS_GW_IP=$(kubectl get svc -n gloo-mesh-gateways istio-ingressgateway -o jsonpath='{.status.loadBalancer.ingress[0].ip}')
    echo $INGRESS_GW_IP
  4. Send a request to the domain.

      echo "Hello" | nc -v $INGRESS_GW_IP 9000

    Example output:

      Connection to port 9000 [tcp/cslistener] succeeded!
    hello-v1 Hello

Next steps

Now that you have the virtual gateway configured, you can add other Gloo Mesh Gateway resources to control traffic that is routed through the gateway.


You can optionally remove the resources that you set up as part of this guide.

  kubectl delete routetable tcp-route -n helloworld
kubectl delete virtualgateway istio-ingressgateway-tcp -n helloworld
kubectl delete deployment helloworld-v1 -n helloworld
kubectl delete deployment helloworld-v2 -n helloworld
kubectl delete deployment helloworld-v3 -n helloworld
kubectl delete deployment helloworld-v4 -n helloworld
kubectl delete service helloworld -n helloworld
kubectl delete namespace helloworld