<p>I am trying to deploy a Service in a Kubernetes Cluster. Everything works fine as long as I do not use TLS.</p>

<p>My Setup is like this:
Azure Kubernetes Cluster with Version 1.15.7
Istio 1.4.2</p>

<p>What I did so far is. Creating the Cluster and Installing Istio with the following Command:</p>

<pre><code>istioctl manifest apply --set values.grafana.enabled=true \--set values.tracing.enabled=true \
--set values.tracing.provider=jaeger \
--set values.global.mtls.enabled=false \
--set values.global.imagePullPolicy=Always \
--set values.kiali.enabled=true \
--set "values.kiali.dashboard.jaegerURL=http://jaeger-query:16686" \
--set "values.kiali.dashboard.grafanaURL=http://grafana:3000"
</code></pre>

<p>Everything starts up and all pods are running.
Then I create a Gateway</p>

<pre><code>apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: ddhub-ingressgateway
  namespace: config
spec:
  selector:
    istio: ingressgateway
  servers:
    - port:
        number: 80
        name: http
        protocol: HTTP
      hosts:
        - "*.example.de"
    #  tls:
    #    httpsRedirect: true # sends 301 redirect for http requests
    - port:
        number: 443
        name: https
        protocol: HTTPS
      tls:
        mode: SIMPLE
        serverCertificate: /etc/istio/ingressgateway-certs/tls.crt
        privateKey: /etc/istio/ingressgateway-certs/tls.key
      hosts:
        - "*.example.de"
    - port:
        number: 31400
        name: tcp
        protocol: TCP
      hosts:
        - "*.example.de"
</code></pre>

<p>I then import my custom certificates which I assume also work since they are mounted correctly and when accessing my service over the browser I can see the secured connection properties with all values.</p>

<p>This is my deployed service:</p>

<pre><code>kind: Service
apiVersion: v1
metadata:
  name: hellohub-frontend
  labels:
    app: hellohub-frontend
  namespace: dev
spec:
  ports:
    - protocol: TCP
      port: 8080
      targetPort: 8080
  type: ClusterIP
  selector:
    app: hellohub-frontend
---
apiVersion: extensions/v1beta1
kind: Deployment
metadata:
  name: hellohub-frontend
  namespace: dev
spec:
  replicas: 1
  template:
    metadata:
      labels:
        app: hellohub-frontend
    spec:
      containers:
        - image: ddhubregistry.azurecr.io/hellohub-frontend:latest
          imagePullPolicy: Always
          name: hellohub-frontend
          volumeMounts:
          - name: azure
            mountPath: /cloudshare
          ports:
          - name: http
            containerPort: 8080
      volumes:
      - name: azure
        azureFile:
          secretName: cloudshare-dev
          shareName: ddhub-share-dev
          readOnly: true
</code></pre>

<p>and the Virtual Service:</p>

<pre><code>apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: hellohub-frontend
  namespace: dev
spec:
  hosts:
    - "dev-hellohub.example.de"
  gateways:
    - config/ddhub-ingressgateway
  http:
    - match:
        - uri:
            prefix: /
      route:
        - destination:
            host: hellohub-frontend.dev.svc.cluster.local
            port:
              number: 8080
</code></pre>

<p>When I access the service with http. The page of my service shows up. When using https I always get "upstream connect error or disconnect/reset before headers. reset reason: connection termination".</p>

<p>What am I missing or what am I doing wrong? What is the difference that makes Kubernetes not finding my service. I understand that my config terminates TLS at the gateway and the communication inside the cluster is the same but this seems not to be the case.</p>

<p>Another question is how to enable debug logs for the Sidecars. I could not find a working way.</p>

<p>Thanks in advance!</p>

Quorgel
<p>Have you tried using istioctl to change log level of istio-proxy. </p>

<pre><code>istioctl proxy-config log &lt;pod-name[.namespace]&gt; --level all:warning,http:debug,redis:debug
</code></pre>
