<p><a href="https://istio.io/" rel="nofollow noreferrer">Istio</a> can be deployed via <a href="https://preliminary.istio.io/docs/reference/config/istio.operator.v1alpha1/" rel="nofollow noreferrer">IstioOperator</a>.</p>

<p>You can patch anything created by a certain component using the <a href="https://istio.io/docs/reference/config/istio.operator.v1alpha1/#K8sObjectOverlay" rel="nofollow noreferrer">K8sObjectOverlay</a>, which takes a <a href="https://istio.io/docs/reference/config/istio.operator.v1alpha1/#K8sObjectOverlay-PathValue" rel="nofollow noreferrer">PathValue</a>. I cannot for the life of me understand how to provide complicated PathValues.</p>

<p>Here are some <a href="https://istio.io/zh/docs/reference/config/istio.operator.v1alpha12.pb/" rel="nofollow noreferrer">example</a> <a href="https://github.com/istio/operator/blob/master/samples/pilot-advanced-override.yaml" rel="nofollow noreferrer">patches</a> I've found (search for "patches:" on those pages) in case it helps.</p>

<p>The patch I'm trying to apply is changing the default ingressGateway that gets created from:</p>

<pre class="lang-yaml prettyprint-override"><code>...
spec:
  profile: default
  components:
    ingressGateways:
      - namespace: istio-system
        name: istio-ingressgateway
        enabled: true
</code></pre>

<p>I can view the default ingress gateway that gets created with <code>kubectl edit gateway/ingressgateway -n istio-system</code> and see this snippet:</p>

<pre class="lang-yaml prettyprint-override"><code>spec:
  servers:
  - hosts:
    - '*'
    port:
      name: http
      number: 80
      protocol: HTTP
</code></pre>

<p>My goal is to change it to this:</p>

<pre class="lang-yaml prettyprint-override"><code>spec:
  selector:
    istio: ingressgateway # use istio default controller
  servers:
    - port:
        number: 80
        name: http
        protocol: HTTP
      hosts:
        - "*"
      tls:
        httpsRedirect: true # sends 301 redirect for http requests
    - port:
        number: 443
        name: https-443
        protocol: HTTPS
      hosts:
        - "*"
      tls:
        mode: SIMPLE # enables HTTPS on this port
        serverCertificate: /etc/istio/ingressgateway-certs/tls.crt
        privateKey: /etc/istio/ingressgateway-certs/tls.key
</code></pre>

<p>I believe that the ObjectOverlay that I should add to the first YAML block above should start with something like this:</p>

<pre class="lang-yaml prettyprint-override"><code>        k8s:
          overlays:
            - apiVersion: networking.istio.io/v1beta1
              Kind: Gateway
              name: ingressgateway
              patches:
                - path: spec.servers.
</code></pre>

<p>but I don't know how to specify that I want to add <code>tls.httpsRedirect: true</code> to the first list item, or how to create a list item with the relatively complicated values above.</p>

<p>The <a href="https://istio.io/docs/reference/config/istio.operator.v1alpha1/#K8sObjectOverlay-PathValue" rel="nofollow noreferrer">PathValue</a> docs I linked above are not clear to me. Istio itself just links to <a href="https://stackoverflow.com/questions/tagged/istio">StackOverflow with the [Istio] Tag</a>, so I guess this is where I come for help.</p>

<p>You will have to provide a whole array as a patch. 
Here is a working example on v1.4.9:</p>

<pre><code>apiVersion: install.istio.io/v1alpha2
kind: IstioOperator
spec:
  profile: default
  gateways:
    components:
      ingressGateway:
        enabled: true
        k8s:
          overlays:
            - kind: Gateway
              name: ingressgateway
              patches:
                - path: spec.servers
                  value:
                    - port:
                        number: 80
                        name: http
                        protocol: HTTP
                      hosts:
                        - "*"
                    - port:
                        number: 443
                        name: domain-com
                        protocol: HTTPS
                      tls:
                        mode: SIMPLE
                        serverCertificate: /etc/istio/ingressgateway-certs/tls.crt
                        privateKey: /etc/istio/ingressgateway-certs/tls.key
                      hosts:
                        - "*.domain.com"
</code></pre>
