<p>I'm currently trying to wrap my head around how the typical application flow looks like for a kubernetes application in combination with Istio.</p>
<p>So, for my app I have an asp.net application hosted within a Kubernetes cluster, and I added Istio on top. Here is my gateway &amp; VirtualService:</p>
<pre><code>apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: appgateway
spec:
  selector:
    istio: ingressgateway
  servers:
    - port:
        number: 80
        name: http
        protocol: HTTP
      hosts:
        - &quot;*&quot;
      tls:
        httpsRedirect: true
    - port:
        number: 443
        name: https
        protocol: HTTPS
      tls:
        mode: SIMPLE
        serverCertificate: /etc/istio/ingressgateway-certs/tls.crt
        privateKey: /etc/istio/ingressgateway-certs/tls.key
      hosts:
        - &quot;*&quot;
---
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: appvservice
spec:
  hosts:
    - &quot;*&quot;
  gateways:
    - appgateway
  tls:
    - match:
        - port: 443
          sniHosts:
            - &quot;*&quot;
      route:
        - destination:
            host: frontendservice.default.svc.cluster.local
            port:
              number: 443
</code></pre>
<p>This is what I came up with after reading through the Istio documentation.</p>
<p>Note that my <code>frontendservice</code> is a very basic ClusterIP service routing to an Asp.Net application which also offers standard 80 / 443 ports.</p>
<p>I have a few questions now:</p>
<ul>
<li>Is this the proper approach to securing my application? In essence I want to redirect incoming traffic on port 80 straight to https enabled 443 right at the edge. However, when I try this, there's no redirect going on on port 80 at all.</li>
<li>Also, the tls route on my VirtualService does not work. There's just no traffic ending up on my pod</li>
<li>I'm also wondering, is it necessary to even manually add HTTPs to my internal applications, or is this something where Istios internal CA functionality comes in?</li>
</ul>
<p>I have imagined it to work like this:</p>
<ol>
<li>Request comes in. If it's on port 80, send a redirect to the client in order to send a https request. If it's on port 443, allow the request.</li>
<li>The VirtualService providers the instructions what should happen with requests on port 443, and forward it to the service.</li>
<li>The service now forwards the request to my app's 443 port.</li>
</ol>
<p>Thanks in advance - I'm just learning Istio, and I'm a bit baffled why my seemingly proper setup does not work here.</p>

<p>Your Gateway terminates TLS connections, but your VirtualService is configured to accept <a href="https://istio.io/latest/docs/reference/config/networking/virtual-service/#TLSRoute" rel="nofollow noreferrer">unterminated TLS connections with TLSRoute</a>.</p>
<p>Compare the <a href="https://istio.io/latest/docs/tasks/traffic-management/ingress/ingress-sni-passthrough/" rel="nofollow noreferrer">example without TLS termination</a> and the example <a href="https://istio.io/latest/docs/reference/config/networking/gateway" rel="nofollow noreferrer">which terminates TLS</a>. Most probably, the &quot;default&quot; setup would be to terminate the TLS connection and configure the VirtualService with a <a href="https://istio.io/latest/docs/reference/config/networking/virtual-service/#HTTPRoute" rel="nofollow noreferrer">HTTPRoute</a>.</p>
