istio: ingressgateway can't access https service with TLS termination.

@yonwon01 I do now work on Istio starting from 2020, sorry. The issue was closed at some point.

@vadimeisenbergibm Thank you very much for your time and patience.

That’s curious. I tested changing (1) The prefix indent and (2) Removing the istio: ingressgateway. One of those things made it work; too bad I did it at the same time.

Reverting back both changes is not causing the 404 anymore (Is there some caching mechanism with the rules in the Istio proxy?)

Two more things to try:

1. Indent prefix to the right, under uri
2. Set the hosts in the gateway to istio.iterativo.do

I’m having the same problem; I’m getting 404 when using HTTPS. Port 80 working great.

Config files

apiVersion: v1
kind: Service
metadata:
  name: odoo-service
  labels:
    app: odoo
    istio: ingressgateway
  namespace: default
spec:
  selector:
    app: odoo
  ports:
  - name: https-odoo
    port: 8069
    targetPort: 8069
  - name: http-odoo
    port: 8069
    targetPort: 8069
  - name: http-longpolling
    port: 8072
    targetPort: 8072
---
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: istio-odoo
spec:
  gateways:
  - istio-odoo.default
  hosts:
  - istio.iterativo.do
  http:
  - match:
    - uri:
      prefix: /
    route:
    - destination:
        host: odoo-service.default.svc.cluster.local
        port:
          number: 8069
  - match:
    - uri:
      prefix: /longpolling
    route:
    - destination:
        host: odoo-service.default.svc.cluster.local # Destination service, must match service name
        port:
          number: 8072
---
apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: istio-odoo # Individual name (we'll use this later in VirtualServer)
  namespace: default # Namespace
spec:
  selector:
    istio: ingressgateway # Specify the ingressgateway created for us by GKE
  servers:
  - hosts:
    - '*'
    port:
      name: http
      number: 80
      protocol: HTTP2
  - hosts:
    - '*'
    port:
      name: https-default
      number: 443
      protocol: HTTPS
    tls:
      mode: SIMPLE
      privateKey: /etc/istio/ingressgateway-certs/tls.key
      serverCertificate: /etc/istio/ingressgateway-certs/tls.crt

Curl result

* Rebuilt URL to: https://istio.iterativo.do/
*   Trying 34.74.1.138...
* TCP_NODELAY set
* Connected to istio.iterativo.do (34.74.1.138) port 443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* Cipher selection: ALL:!EXPORT:!EXPORT40:!EXPORT56:!aNULL:!LOW:!RC4:@STRENGTH
* successfully set certificate verify locations:
*   CAfile: /etc/ssl/certs/ca-certificates.crt
  CApath: /etc/ssl/certs
* TLSv1.2 (OUT), TLS header, Certificate Status (22):
* TLSv1.2 (OUT), TLS handshake, Client hello (1):
* TLSv1.2 (IN), TLS handshake, Server hello (2):
* TLSv1.2 (IN), TLS handshake, Certificate (11):
* TLSv1.2 (IN), TLS handshake, Server key exchange (12):
* TLSv1.2 (IN), TLS handshake, Server finished (14):
* TLSv1.2 (OUT), TLS handshake, Client key exchange (16):
* TLSv1.2 (OUT), TLS change cipher, Client hello (1):
* TLSv1.2 (OUT), TLS handshake, Finished (20):
* TLSv1.2 (IN), TLS change cipher, Client hello (1):
* TLSv1.2 (IN), TLS handshake, Finished (20):
* SSL connection using TLSv1.2 / ECDHE-RSA-AES128-GCM-SHA256
* ALPN, server accepted to use h2
* Server certificate:
*  subject: CN=iterativo.do
*  start date: Aug 19 03:06:20 2019 GMT
*  expire date: Nov 17 03:06:20 2019 GMT
*  issuer: C=US; O=Let's Encrypt; CN=Let's Encrypt Authority X3
*  SSL certificate verify ok.
* Using HTTP2, server supports multi-use
* Connection state changed (HTTP/2 confirmed)
* Copying HTTP/2 data in stream buffer to connection buffer after upgrade: len=0
* Using Stream ID: 1 (easy handle 0x55ea197b7e80)
> GET / HTTP/1.1
> Host: istio.iterativo.do
> User-Agent: curl/7.52.1
> Accept: */*
>
* Connection state changed (MAX_CONCURRENT_STREAMS updated)!
< HTTP/2 404
< location: https://istio.iterativo.do/
< date: Mon, 19 Aug 2019 05:43:39 GMT
< server: istio-envoy
<
* Curl_http_done: called premature == 0
* Connection #0 to host istio.iterativo.do left intact

Any updates on what I might be doing wrong?