apiVersion: networking.istio.io/v1
kind: ServiceEntry
metadata:
  name: example.com
  namespace: istio-system
spec:
  hosts:
  - example.com
  ports:
  - number: 443
    name: https
    protocol: HTTPS
  resolution: DNS

apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: selfsigned
spec:
  selfSigned: {}

apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: ca
  namespace: cert-manager
spec:
  isCA: true
  commonName: ca
  secretName: ca-secret
  duration: 175200h
  privateKey:
    algorithm: RSA
    size: 2048
  issuerRef:
    name: selfsigned
    kind: ClusterIssuer
    group: cert-manager.io

apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: server-issuer
spec:
  ca:
    secretName: ca-secret

apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: egress-server-cert
  namespace: istio-egress
spec:
  commonName: egress-server-cert
  secretName: egress-server-cert-secret
  duration: 8760h
  privateKey:
    algorithm: RSA
    size: 2048
  dnsNames:
    - example.com
  issuerRef:
    name: server-issuer
    kind: ClusterIssuer
    group: cert-manager.io

apiVersion: networking.istio.io/v1
kind: Gateway
metadata:
  name: gateway
  namespace: istio-egress
spec:
  selector:
    app: istio-egressgateway
    istio: egressgateway
  servers:
  - hosts:
    - '*'
    port:
      name: https-port
      number: 443
      protocol: HTTPS
    tls:
      credentialName: egress-server-cert-secret # здесь будет сертификат для tls
      mode: SIMPLE

RUN curl 'https://my.internal.storage/CA.crt' -o '/usr/local/share/ca-certificates/CA.crt'
RUN /usr/sbin/update-ca-certificates

apiVersion: networking.istio.io/v1
kind: VirtualService
metadata:
  name: example.com
  namespace: default
spec:
  hosts:
  - example.com
  tls:
  - match:
    - port: 443
      sniHosts:
      - example.com
    route:
    - destination:
        host: istio-egressgateway.istio-egress.svc.cluster.local

apiVersion: networking.istio.io/v1
kind: DestinationRule
metadata:
  name: example.com
  namespace: istio-system
spec:
  host: example.com
  trafficPolicy:
    portLevelSettings:
    - port:
        number: 443
      tls:
        mode: SIMPLE