<p>My application is running a SSL NodeJS server with mutual authentication.
How do I tell k8s to access the container thought HTTPS?
How do I forward the client SSL certificates to the container?</p>
<p>I tried to setup a Gateway &amp; a Virtual host without success. In every configuration I tried I hit a 503 error.</p>

Antoine
<p>The Istio sidecar proxy container (when injected) in the pod will automatically handle communicating over HTTPS. The application code can continue to use HTTP, and the Istio sidecar will intercept the request, &quot;upgrading&quot; it to HTTPS. The sidecar proxy in the receiving pod will then handle &quot;downgrading&quot; the request to HTTP for the application container.</p>
<p>Simply put, there is no need to modify any application code. The Istio sidecar proxies requests and responses between Kubernetes pods with TLS/HTTPS.</p>
<p><strong>UPDATE:</strong></p>
<p>If you wish to use HTTPS at the application level, you can tell Istio to exclude certain inbound and outbound ports. To do so, you can add the <code>traffic.sidecar.istio.io/excludeInboundPorts</code> and <code>traffic.sidecar.istio.io/excludeOutboundPorts</code> annotations, respectively, to the Kubernetes deployment YAML.</p>
<p>Example:</p>
<pre><code>...
spec:
  selector:
    matchLabels:
      app: podinfo
  template:
    metadata:
      annotations:
        traffic.sidecar.istio.io/includeInboundPorts: &quot;443&quot;
        traffic.sidecar.istio.io/excludeInboundPorts: &quot;443&quot;
      labels:
...
</code></pre>
