<p>When I configure multiple (gateway - virtual service) pairs in a namespace, each pointing to basic HTTP services, only one service becomes accessable. Calls to the other (typically, the second configured) return 404. If the first gateway is deleted, the second service then becomes accesible</p>

<p>I raised a github issue a few weeks ago  ( <a href="https://github.com/istio/istio/issues/20661" rel="nofollow noreferrer">https://github.com/istio/istio/issues/20661</a> ) that contains all my configuration but no response to date. Does anyone know what I'm doing wrong (if anything) ?</p>

Vinay B
<p>Based on that <a href="https://github.com/istio/istio/issues/12500" rel="nofollow noreferrer">github issue</a> </p>

<blockquote>
  <p>The gateway port names have to be unique, if they are sharing the same port. Thats the only way we differentiate different RDS blocks. We went through this motion earlier as well. I wouldn't rock this boat unless absolutely necessary.</p>
</blockquote>

<p>More about the issue <a href="https://github.com/istio/istio/pull/12556" rel="nofollow noreferrer">here</a> </p>

<p>Checked it on <a href="https://istio.io/docs/tasks/traffic-management/ingress/secure-ingress-mount/#configure-traffic-for-the-bookinfo-com-host" rel="nofollow noreferrer">istio documentation</a>, and in fact if you configure multiple gateways name of the first one is https, but second is https-bookinfo.</p>

<pre><code>apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: httpbin-gateway
spec:
  selector:
    istio: ingressgateway # use istio default ingress gateway
  servers:
  - port:
      number: 443
      name: https
      protocol: HTTPS
    tls:
      mode: SIMPLE
      serverCertificate: /etc/istio/ingressgateway-certs/tls.crt
      privateKey: /etc/istio/ingressgateway-certs/tls.key
    hosts:
    - "httpbin.example.com"
</code></pre>

<hr>

<pre><code>apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: bookinfo-gateway
spec:
  selector:
    istio: ingressgateway # use istio default ingress gateway
  servers:
  - port:
      number: 443
      name: https-bookinfo
      protocol: HTTPS
    tls:
      mode: SIMPLE
      serverCertificate: /etc/istio/ingressgateway-bookinfo-certs/tls.crt
      privateKey: /etc/istio/ingressgateway-bookinfo-certs/tls.key
    hosts:
    - "bookinfo.com"
</code></pre>

<hr>

<h2><strong>EDIT</strong></h2>

<p>That's weird, but I have another idea.</p>

<p>There is a <a href="https://github.com/istio/istio/pull/12556" rel="nofollow noreferrer">github pull</a> which have the following line in pilot:</p>

<pre><code>routeName := gatewayRDSRouteName(s, config.Namespace)
</code></pre>

<blockquote>
  <p>This change adds namespace scoping to Gateway port names by appending
  namespace suffix to the HTTPS RDS routes. Port names still have to be
  unique within the namespace boundaries, but this change makes adding
  more specific scoping rather trivial.</p>
</blockquote>

<p>Could you try make 2 namespaces like in below example</p>

<p><strong>EXAMPLE</strong></p>

<pre><code>apiVersion: v1
kind: Namespace
metadata:
  name: httpbin
  labels:
    name: httpbin
    istio-injection: enabled
---
apiVersion: v1
kind: Namespace
metadata:
  name: nodejs
  labels:
    name: nodejs
    istio-injection: enabled
</code></pre>

<p>And deploy everything( deployment,service,virtual service,gateway) in proper namespace and let me know if that works?</p>

<hr>

<p>Could You try change the hosts from "*" to some names? It's only thing that came to my mind besides trying serverCertficate and privateKey but from the comments I assume you have already try it.</p>

<p>Let me know if that help.</p>
