<p>I had an Istio mesh with mtls disabled with following pods and services. I'm using kubeadm.</p>

<pre><code>pasan@ubuntu:~$ kubectl get pods --all-namespaces
NAMESPACE       NAME                                                       READY     STATUS      RESTARTS   AGE
default         debug-tools                                                2/2       Running     0          2h
default         employee--debug-deployment-57947cf67-gwpjq                 2/2       Running     0          2h
default         employee--employee-deployment-5f4d7c9d78-sfmtx             2/2       Running     0          2h
default         employee--gateway-deployment-bc646bd84-wnqwq               2/2       Running     0          2h
default         employee--salary-deployment-d4969d6c8-lz7n7                2/2       Running     0          2h
default         employee--sts-deployment-7bb9b44bf7-lthc8                  1/1       Running     0          2h
default         hr--debug-deployment-86575cffb6-6wrlf                      2/2       Running     0          2h
default         hr--gateway-deployment-8c488ff6-827pf                      2/2       Running     0          2h
default         hr--hr-deployment-596946948d-rzc7z                         2/2       Running     0          2h
default         hr--sts-deployment-694d7cff97-4nz29                        1/1       Running     0          2h
default         stock-options--debug-deployment-68b8fccb97-4znlc           2/2       Running     0          2h
default         stock-options--gateway-deployment-64974b5fbb-rjrwq         2/2       Running     0          2h
default         stock-options--stock-deployment-d5c9d4bc8-dqtrr            2/2       Running     0          2h
default         stock-options--sts-deployment-66c4799599-xx9d4             1/1       Running     0          2h

pasan@ubuntu:~$ kubectl get services
NAME                             TYPE        CLUSTER-IP       EXTERNAL-IP   PORT(S)             AGE
employee--debug-service          ClusterIP   10.104.23.141    &lt;none&gt;        80/TCP              2h
employee--employee-service       ClusterIP   10.96.203.80     &lt;none&gt;        80/TCP              2h
employee--gateway-service        ClusterIP   10.97.145.188    &lt;none&gt;        80/TCP              2h
employee--salary-service         ClusterIP   10.110.167.162   &lt;none&gt;        80/TCP              2h
employee--sts-service            ClusterIP   10.100.145.102   &lt;none&gt;        8080/TCP,8081/TCP   2h
hr--debug-service                ClusterIP   10.103.81.158    &lt;none&gt;        80/TCP              2h
hr--gateway-service              ClusterIP   10.106.183.101   &lt;none&gt;        80/TCP              2h
hr--hr-service                   ClusterIP   10.107.136.178   &lt;none&gt;        80/TCP              2h
hr--sts-service                  ClusterIP   10.105.184.100   &lt;none&gt;        8080/TCP,8081/TCP   2h
kubernetes                       ClusterIP   10.96.0.1        &lt;none&gt;        443/TCP             2h
stock-options--debug-service     ClusterIP   10.111.51.88     &lt;none&gt;        80/TCP              2h
stock-options--gateway-service   ClusterIP   10.100.81.254    &lt;none&gt;        80/TCP              2h
stock-options--stock-service     ClusterIP   10.96.189.100    &lt;none&gt;        80/TCP              2h
stock-options--sts-service       ClusterIP   10.108.59.68     &lt;none&gt;        8080/TCP,8081/TCP   2h
</code></pre>

<p>I accessed this service using a debug pod using the following command:</p>

<pre><code>curl -X GET http://hr--gateway-service.default:80/info -H "Authorization: Bearer $token" -v
</code></pre>

<p>As the next step, I enabled mtls in the mesh. As expected the above curl command failed.</p>

<p>Now I want to set up an ingress controller so I can access the service mesh as I did before.</p>

<p>So I set up Gateway and VirtualService as below:</p>

<pre><code>cat &lt;&lt;EOF | kubectl apply -f -
apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: hr-ingress-gateway
spec:
  selector:
    istio: ingressgateway # use Istio default gateway implementation
  servers:
  - port:
      number: 80
      name: http
      protocol: HTTP
    hosts:
    - "hr--gateway-service.default"
EOF


cat &lt;&lt;EOF | kubectl apply -f -
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: hr-ingress-virtual-service
spec:
  hosts:
  - "*"
  gateways:
  - hr-ingress-gateway
  http:
  - match:
    - uri:
        prefix: /info/
    route:
    - destination:
        port:
          number: 80
        host: hr--gateway-service
EOF
</code></pre>

<p>But still I'm getting the following output</p>

<pre><code>wso2carbon@gateway-5bd88fd679-l8jn5:~$ curl -X GET http://hr--gateway-service.default:80/info -H "Authorization: Bearer $token" -v
Note: Unnecessary use of -X or --request, GET is already inferred.
*   Trying 10.106.183.101...
* Connected to hr--gateway-service.default (10.106.183.101) port 80 (#0)
&gt; GET /info HTTP/1.1
&gt; Host: hr--gateway-service.default
&gt; User-Agent: curl/7.47.0
&gt; Accept: */*
...
* Recv failure: Connection reset by peer
* Closing connection 0
curl: (56) Recv failure: Connection reset by peer
</code></pre>

<p>Can you please let me know if my ingress set up is correct and how I can access the service using curl after the set up.
My Ingress services are listed as below:</p>

<pre><code>ingress-nginx   default-http-backend                    ClusterIP   10.105.46.168    &lt;none&gt;         80TCP                                                                                                                    3h
ingress-nginx   ingress-nginx                           NodePort    10.110.75.131    172.17.17.100   80:30770/TCP,443:32478/TCP
istio-ingressgateway       NodePort    10.98.243.205    &lt;none&gt;        80:31380/TCP,443:31390/TCP,31400:31400/TCP,15011:31775/TCP,8060:32436/TCP,853:31351/TCP,15030:32149/TCP,15031:32653/TCP   3h
</code></pre>

Pasan W.
<p>@Pasan to apply Istio CRDs (VirtualServices) to incoming traffic you need to use Istio's Ingress Gateway as a point of ingress as seen here: <a href="https://istio.io/docs/tasks/traffic-management/ingress/" rel="nofollow noreferrer">https://istio.io/docs/tasks/traffic-management/ingress/</a></p>

<p>The ingressgateway is a wrapper around the envoy which is configurable using Istio's CRDs.</p>

<p>Basically, you don't need a second ingress controller and during istio installation, the default one is installed, find out by executing:</p>

<pre><code>kubectl get services -n istio-system -l app=istio-ingressgateway
</code></pre>

<p>and with the Ingress Gateway ip execute:</p>

<pre><code>curl -X GET http://{INGRESSGATEWAY_IP}/info -H "Authorization: Bearer $token" -H "Host: hr--gateway-service.default"
</code></pre>

<p>I added the host as a header as it is defined in the Gateway meaning that only for this host ingress is allowed.</p>
