Istio Ingress with cert-manager

Question

I have Kubernetes with Kafka where is also running Istio with Strimzi. Certificates are stored in cert-manager. I want to use TLS passthrough in my ingress but I am a little bit confused of that.

When SIMPLE is used, there is credentialName, which must be the same as secret.

tls:
  mode: SIMPLE
  credentialName: httpbin-credential

It is nice and simple way. But how about mode: PASSTHROUGH when I have many hosts? I studied demo on istio web (https://istio.io/latest/docs/tasks/traffic-management/ingress/ingress-sni-passthrough/#deploy-an-nginx-server) and their certificate details are stored in server configuration file and they are creating configmap. In official Istio documentation is noted that this parameter is only for MUTUAL and SIMPLE.

What is correct and simple way to expose my hosts using istio ingress to external traffic using cert-manager?

Answer 1

The difference between SIMPLE & PASSTHROUGH is:

• SIMPLE TLS instructs the gateway to pass the ingress traffic by terminating TLS.
• PASSTHROUGH TLS instructs the gateway to pass the ingress traffic AS IS, without terminating TLS.