<p>How can I setup a single gateway in Istio 1.9 and multiple VirtualServices (each one in a different namespace).
I can't set one gateway to each virtualservice because browsers leverage HTTP/2 <a href="https://httpwg.org/specs/rfc7540.html#reuse" rel="nofollow noreferrer">connection reuse</a> to produce 404 errors.</p>
<p>If I follow <a href="https://istio.io/latest/docs/ops/common-problems/network-issues/#404-errors-occur-when-multiple-gateways-configured-with-same-tls-certificate" rel="nofollow noreferrer">these instructions</a> it won't work because gateway and virtualservice can't be in different namespaces.</p>
<p>These are the manifest files:</p>
<p>APP1:</p>
<pre><code>apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: app1-gateway
  namespace: app1
spec:
  selector:
    istio: ingressgateway # use istio default controller
  servers:
  - port:
      number: 80
      name: http
      protocol: HTTP
    hosts:
    - &quot;app1.example.com&quot;
    tls:
      httpsRedirect: true # sends 301 redirect for http requests
  - port:
      number: 443
      name: https-app1
      protocol: HTTPS
    tls:
      mode: SIMPLE
      credentialName: sslcertificate
    hosts:
    - &quot;app1.example.com&quot;
---
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: app1
  namespace: app1
spec:
  hosts:
  - &quot;app1.example.com&quot;
  gateways:
  - app1-gateway
  http:
  - match:
    - uri:
        prefix: /
    route:
    - destination:
        host: app1
        port:
          number: 80
</code></pre>
<p>APP2:</p>
<pre><code>apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: app2-gateway
  namespace: app2
spec:
  selector:
    istio: ingressgateway # use istio default controller
  servers:
  - port:
      number: 80
      name: http
      protocol: HTTP
    hosts:
    - &quot;app2.example.com&quot;
    tls:
      httpsRedirect: true # sends 301 redirect for http requests
  - port:
      number: 443
      name: https-app2
      protocol: HTTPS
    tls:
      mode: SIMPLE
      credentialName: sslcertificate
    hosts:
    - &quot;app2.example.com&quot;
---
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: app2
  namespace: app2
spec:
  hosts:
  - &quot;app2.example.com&quot;
  gateways:
  - app2-gateway
  http:
  - match:
    - uri:
        prefix: /
    route:
    - destination:
        host: app2
        port:
          number: 80
</code></pre>

<p>To answer your question, <code>because gateway and virtualservice can't be in different namespaces</code>, actually they can be in a different namespaces.</p>
<p>If it´s not in the same namespace as virtual service you just have to specify that namespace in your virtual service <code>spec.gateways</code>.</p>
<p>Check the <code>spec.gateways</code> section</p>
<pre><code>apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: bookinfo-Mongo
  namespace: bookinfo-namespace
spec:
  gateways:
  - some-config-namespace/my-gateway # can omit the namespace if gateway is in same
                                       namespace as virtual service.
</code></pre>
<hr />
<pre><code>apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: my-gateway
  namespace: some-config-namespace
</code></pre>
<p>There is related  <a href="https://istio.io/docs/reference/config/networking/gateway/" rel="nofollow noreferrer">istio documentation</a> about that.</p>
