How to expose services with a private LoadBalancer?

[kszlachcikowski]

I have the following use case:

1. The cluster hosts multiple services with varying levels of access required.
2. Some need to be exposed with a public IP over the internet with a public domain name. This is covered by Knative Serving + Kourier with a DomainMapping.
3. Some need to be cluster-local. This is the default so also covered.
4. Some services need to be exposed outside of the cluster but using a private LoadBalancer (private IP) AND resolvable domain name.

Is 4 possible to achieve within the same cluster?
I've already tried setting up a secondary LB with the private IP as well as additional DomainMappings and the cluster-local annotations but whatever I do the service is always published to the public LB as long as a DomainMapping exists.

[dprotaso]

The only net-* plugin that would support this is net-istio - you can have different gateways for different knative services using the config option here

https://github.com/knative-extensions/net-istio/blob/1d8e2573b1e0d7a3800f6a4052b654c818c2762d/config/400-config-istio.yaml#L49

The use case you describe is similar to the person who authored this change.