https://blog.lwolf.org/post/switching_to_istio_as_the_primary_ingress/

istio-gateway-tls.yaml

apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: service-gw
  namespace: istio-system
spec:
  selector:
    istio: ingressgateway
  servers:
    - port:
        number: 443
        name: https-system
        protocol: HTTPS
      hosts:
      - "grafana.example.com"
      - "kiali.example.com"
      - "prometheus.example.com"
      - "jaeger.example.com"
      tls:
        mode: SIMPLE
        privateKey: /etc/istio/example-com-certs/tls.key
        serverCertificate: /etc/istio/example-com-certs/tls.crt