Apps not available via HTTPS

[acosta11]

Summary

HTTPS traffic does not reach apps running on cf-for-k8s.

Repro Steps

1. Deploy cf-for-k8s and log in via the cf CLI
2. Enable feature flag 'diego_docker'
3. Target a space and push a docker app
4. Attempt to curl the route provided in the push output and observe it is only available over unencrypted http.

> cf push myapp -o cloudfoundry/diego-docker-app

> curl -i http://myapp.<app-domain>
HTTP/1.1 200 OK
date: Wed, 26 Feb 2020 00:21:36 GMT
content-length: 1
content-type: text/plain; charset=utf-8
x-envoy-upstream-service-time: 3
server: istio-envoy

0

> curl -i https://myapp.<app-domain> -k
HTTP/2 404
date: Wed, 26 Feb 2020 00:21:18 GMT
server: istio-envoy

Context

Currently, there are two istio ingress gateways: one for the cf-system components and one for cf-workloads. The ingress gateway for cf-workloads namespace only configures a rule for unencrypted http traffic to port 80. Meanwhile the system component ingress gateway only listens for encrypted https traffic on port 443. So any encrypted https traffic to port 443 only matches the routing rule on the cf-system gateway and receives an istio 404 response. We expect to work with the cf-for-k8s networking team to resolve this issue.

[cf-gitbot]

We have created an issue in Pivotal Tracker to manage this:

https://www.pivotaltracker.com/story/show/171482241

The labels on this github issue will be updated when the story is started.

[loewenstein]

Has this been solved by #64?

[XanderStrike]

#64 provided documentation for how users could enable TLS by providing their own certs. The story title was misleading, I've updated the PR to better reflect the work that was actually done.

The story to enable TLS for ingress by default is here and it is prioritized high in our backlog.

[jamespollard8]

Closed by #179