<p>How can I configure Istio VirtualService to route traffic to a destination backend that listens on HTTPS?</p>

<p>configuring <code>protocol: HTTPS</code> or <code>scheme: HTTPS</code> didn't work.</p>

<pre><code>apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: api-rpi-access
spec:
  hosts:
  - "test.example.com"
  gateways:
  - api-gateway
  http:
  - match:
    - uri:
        port: https
        prefix: /
    route:
    - destination:
        host: some-https-service
        port:
          number: 8443
          protocol: HTTPS
        # scheme: HTTPS
</code></pre>

<p>Here is my gateway:</p>

<pre><code>apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: api-gateway
spec:
  selector:
    istio: ingressgateway
  servers:
  - port:
      number: 443
      name: https
      protocol: HTTPS
    tls:
      mode: SIMPLE
      serverCertificate: /etc/istio/ingressgateway-certs/tls.crt
      privateKey: /etc/istio/ingressgateway-certs/tls.key
    hosts:
    - "test.example.com"
</code></pre>

<p>In order to perform the TLS termination on istio-ingressgateway and send https traffic to the backend, I had to add the following <code>DestinationRule</code></p>
<pre><code>apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
  name: some-https-service
spec:
  host: diary
  trafficPolicy:
    tls:
      mode: SIMPLE
</code></pre>
<p>here are the yamls for <code>Gateway</code> and <code>VirtualService</code>:</p>
<pre><code>apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: api-gateway
spec:
  selector:
    istio: ingressgateway
  servers:
  - port:
      number: 443
      name: https
      protocol: HTTPS
    tls:
      mode: SIMPLE
      serverCertificate: /etc/istio/ingressgateway-certs/tls.crt
      privateKey: /etc/istio/ingressgateway-certs/tls.key
    hosts:
    - &quot;test.example.com&quot;
---
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: ext-access
spec:
  hosts:
  - &quot;test.example.com&quot;
  gateways:
  - api-gateway
  http:
  - match:
    - uri:
        port: https
        prefix: /
    route:
    - destination:
        host: some-https-service
        port:
          number: 8443
</code></pre>
