Gateway L1 + L2

gateways.yaml

apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
  name: gateway
  namespace: istio-system
spec:
  gatewayClassName: istio
  listeners:
  - name: http
    protocol: HTTP
    port: 80
  - name: tls
    protocol: TLS
    port: 443 
    hostname: "*.example.com"    
    tls:
      mode: Passthrough
    allowedRoutes:
      namespaces:
        from: All

---
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: http-redirect
  namespace: istio-system
spec:
  parentRefs:
  - name: gateway
    namespace: istio-system
    sectionName: http
  hostnames: 
    - "*.example.com"
  rules:
    - filters:
        - type: RequestRedirect
          requestRedirect:
            scheme: https
            statusCode: 301

---
apiVersion: gateway.networking.k8s.io/v1alpha2
kind: TLSRoute
metadata:
  name: application
  namespace: application
spec:
  parentRefs:
  - name: gateway
    namespace: istio-system
    sectionName: tls
  hostnames: 
    - "application.example.com"
  rules:
  - backendRefs:
      - name: application-tls-istio
        namespace: application
        port: 443

---
apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
  name: application-tls
  namespace: application
  annotations:
    networking.istio.io/service-type: ClusterIP
spec:
  gatewayClassName: istio
  listeners:
  - name: https
    protocol: HTTPS # Tried TLS as well
    port: 443
    hostname: "application.example.com"    
    tls:
      mode: Terminate
      certificateRefs:
      - kind: Secret
        group: ""
        name: application-cert # Generated using cert-manager
        namespace: application

---
apiVersion: gateway.networking.k8s.io/v1
# apiVersion: gateway.networking.k8s.io/v1alpha2
kind: HTTPRoute
# kind: TCPRoute
metadata:
  name: https-application-solutions
  namespace: application
  annotations:
    external-dns.alpha.kubernetes.io/exclude: 'true'
spec:
  parentRefs:
  - name: application-tls
    namespace: application
    sectionName: https
  hostnames: 
    - "application.example.com"
  rules:
  - backendRefs:
      - name: application
        port: 80
    matches:
      - path:
          type: PathPrefix
          value: /
---
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: application
  namespace: application
spec:
  dnsNames:
  - application.example.com
  duration: 2160h0m0s
  issuerRef:
    group: cert-manager.io
    kind: ClusterIssuer
    name: letsencrypt
  renewBefore: 360h0m0s
  secretName: application-cert