repeated Ingress items = 2;
}

// IngressLoadBalancerIngress represents the status of a load-balancer ingress point.
message IngressLoadBalancerIngress {
  // ip is set for load-balancer ingress points that are IP based.
  // +optional
  optional string ip = 1;

  // hostname is set for load-balancer ingress points that are DNS based.
  // +optional
  optional string hostname = 2;

  repeated Ingress items = 2;
}

// IngressLoadBalancerIngress represents the status of a load-balancer ingress point.
message IngressLoadBalancerIngress {
  // ip is set for load-balancer ingress points that are IP based.
  // +optional
  optional string ip = 1;

  // hostname is set for load-balancer ingress points that are DNS based.
  // +optional
  optional string hostname = 2;

```console
 helm install -n istio-system istiod manifests/charts/istio-control/istio-discovery --set profile=openshift
```

4) `gateways` charts install a load balancer with `ingress` and `egress`.

Ingress secrets and access should be separated from the control plane.

```console
helm install -n istio-system istio-ingress manifests/charts/gateways/istio-ingress --set profile=openshift

- the new chart uses the default namespace service account, and doesn't require
additional RBAC permissions.

- simplified label structure. Label change is not supported on upgrade.

- for 'internal load balancer' you should deploy a separate gateway, in a different
namespace.

All ingress gateway have a "app:ingressgateway" label, used to identify it as an
ingress, and an "istio: ingressgateway$SUFFIX" label of Gateway selection.

            --set policy.enable=false \
            --set global.istioNamespace=istio-master
```

### Gateways

A cluster may use multiple Gateways, each with a different load balancer IP, domains and certificates.

Since the domain certificates are stored in the gateway namespace, it is recommended to keep each
gateway in a dedicated namespace and restrict access.

  repeated Ingress items = 2;
}

// IngressLoadBalancerIngress represents the status of a load-balancer ingress point.
message IngressLoadBalancerIngress {
  // IP is set for load-balancer ingress points that are IP based.
  // +optional
  optional string ip = 1;

  // Hostname is set for load-balancer ingress points that are DNS based.
  // +optional
  optional string hostname = 2;

// LoadBalancerIngress represents the status of a load-balancer ingress point:
// traffic intended for the service should be sent to an ingress point.
message LoadBalancerIngress {
  // IP is set for load-balancer ingress points that are IP based
  // (typically GCE or OpenStack load-balancers)
  // +optional
  optional string ip = 1;

  // Hostname is set for load-balancer ingress points that are DNS based