<p><a href="https://istio.io/" rel="nofollow noreferrer">Istio</a> can be deployed via <a href="https://preliminary.istio.io/docs/reference/config/istio.operator.v1alpha1/" rel="nofollow noreferrer">IstioOperator</a>.</p>

<p>You can patch anything created by a certain component using the <a href="https://istio.io/docs/reference/config/istio.operator.v1alpha1/#K8sObjectOverlay" rel="nofollow noreferrer">K8sObjectOverlay</a>, which takes a <a href="https://istio.io/docs/reference/config/istio.operator.v1alpha1/#K8sObjectOverlay-PathValue" rel="nofollow noreferrer">PathValue</a>. I cannot for the life of me understand how to provide complicated PathValues.</p>

<p>Here are some <a href="https://istio.io/zh/docs/reference/config/istio.operator.v1alpha12.pb/" rel="nofollow noreferrer">example</a> <a href="https://github.com/istio/operator/blob/master/samples/pilot-advanced-override.yaml" rel="nofollow noreferrer">patches</a> I've found (search for "patches:" on those pages) in case it helps.</p>

<p>The patch I'm trying to apply is changing the default ingressGateway that gets created from:</p>

<pre class="lang-yaml prettyprint-override"><code>...
spec:
  profile: default
  components:
    ingressGateways:
      - namespace: istio-system
        name: istio-ingressgateway
        enabled: true
</code></pre>

<p>I can view the default ingress gateway that gets created with <code>kubectl edit gateway/ingressgateway -n istio-system</code> and see this snippet:</p>

<pre class="lang-yaml prettyprint-override"><code>spec:
  servers:
  - hosts:
    - '*'
    port:
      name: http
      number: 80
      protocol: HTTP
</code></pre>

<p>My goal is to change it to this:</p>

<pre class="lang-yaml prettyprint-override"><code>spec:
  selector:
    istio: ingressgateway # use istio default controller
  servers:
    - port:
        number: 80
        name: http
        protocol: HTTP
      hosts:
        - "*"
      tls:
        httpsRedirect: true # sends 301 redirect for http requests
    - port:
        number: 443
        name: https-443
        protocol: HTTPS
      hosts:
        - "*"
      tls:
        mode: SIMPLE # enables HTTPS on this port
        serverCertificate: /etc/istio/ingressgateway-certs/tls.crt
        privateKey: /etc/istio/ingressgateway-certs/tls.key
</code></pre>

<p>I believe that the ObjectOverlay that I should add to the first YAML block above should start with something like this:</p>

<pre class="lang-yaml prettyprint-override"><code>        k8s:
          overlays:
            - apiVersion: networking.istio.io/v1beta1
              Kind: Gateway
              name: ingressgateway
              patches:
                - path: spec.servers.
</code></pre>

<p>but I don't know how to specify that I want to add <code>tls.httpsRedirect: true</code> to the first list item, or how to create a list item with the relatively complicated values above.</p>

<p>The <a href="https://istio.io/docs/reference/config/istio.operator.v1alpha1/#K8sObjectOverlay-PathValue" rel="nofollow noreferrer">PathValue</a> docs I linked above are not clear to me. Istio itself just links to <a href="https://stackoverflow.com/questions/tagged/istio">StackOverflow with the [Istio] Tag</a>, so I guess this is where I come for help.</p>

<p>This is a part of an overlay that will add another server entry with some example specs. Just tweak it to be the way you want it to be. You can also override your first server entry with a path of spec.servers[0] and then set the value to whatever you want it to be.</p>

<pre><code>ingressGateways: 
  - enabled: true
    k8s:
      overlays:
      - apiVersion: networking.istio.io/v1alpha3
        kind: Gateway
        name: ingressgateway
        patches:
        - path: spec.servers[1]
          value:
            hosts:
              - '*.example.com'
            port:
              name: https
              number: 443
              protocol: HTTPS
            tls:
              credentialName: example-cert
              mode: SIMPLE
              privateKey: sds
              serverCertificate: sds
</code></pre>

<p>Update:
I haven't tried it out, but you could try just defining that expression as the path path, i think it then just set that single value inside the rest of the object:</p>

<pre><code>- path: spec.servers[0].tls.httpsRedirect
  value: true
</code></pre>

<p>It might be necessary to define the entire tls object though, i'm not sure right now if it'd be valid with just the httpsRedirect attribute defined.</p>

<pre><code>- path: spec.servers[0].tls
  value: 
    httpsRedirect: true
    other required attributes defined here just like httpsRedirect
</code></pre>
