kubectl create namespace istio-system

helm upgrade --install istio-base istio/base -n istio-system --set defaultRevision=default

helm upgrade --install istiod istio/istiod -n istio-system --wait

Istio-gateway-deployment:

apiVersion: v1
kind: Service
metadata:
name: istio-ingressgateway
namespace: istio-ingress
spec:
type: LoadBalancer
selector:
istio: ingressgateway
ports:
- port: 80
name: http
- port: 443
name: https

apiVersion: apps/v1
kind: Deployment
metadata:
name: istio-ingressgateway
namespace: istio-ingress
spec:
selector:
matchLabels:
istio: ingressgateway
template:
metadata:
annotations:
# Select the gateway injection template (rather than the default sidecar template)
inject.istio.io/templates: gateway
labels:
# Set a unique label for the gateway. This is required to ensure Gateways can select this workload
istio: ingressgateway
# Enable gateway injection. If connecting to a revisioned control plane, replace with "istio.io/rev: revision-name"
sidecar.istio.io/inject: "true"
spec:
# Allow binding to all ports (such as 80 and 443)
securityContext:
sysctls:
- name: net.ipv4.ip_unprivileged_port_start
value: "0"
containers:
- name: istio-proxy
image: auto # The image will automatically update each time the pod starts.
# Drop all privileges, allowing to run as non-root
securityContext:
capabilities:
drop:
- ALL
runAsUser: 1337
runAsGroup: 1337

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
name: istio-ingressgateway-sds
namespace: istio-ingress
rules:

• apiGroups: [""]
  resources: ["secrets"]
  verbs: ["get", "watch", "list"]

apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
name: istio-ingressgateway-sds
namespace: istio-ingress
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: Role
name: istio-ingressgateway-sds
subjects:

• kind: ServiceAccount
  name: default

gateway:

apiVersion: networking.istio.io/v1
kind: Gateway
metadata:
name: knockfashion-gateway
namespace: istio-ingress # Correct namespace for the gateway
spec:
selector:
istio: ingressgateway # This label should match your Istio ingress gateway
servers:
- port:
number: 80
name: http
protocol: HTTP
hosts:
- "*" # The domain for your service

my ingress yaml:

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: notification-ingress-static
namespace: uat-aus
spec:
ingressClassName: nginx
rules:
- host: notification.uat.knockfashion.com
http:
paths:
- path: /notification-service
pathType: Prefix
backend:
service:
name: notification-deployment-service
port:
number: 8088

Virtual-service yaml:

apiVersion: networking.istio.io/v1
kind: VirtualService
metadata:
name: notification-virtualservice
namespace: uat-aus
spec:
hosts:
- "uat.knockfashion.com"
gateways:
- istio-ingress/knockfashion-gateway
- mesh
http:
- match:
- uri:
prefix: /notification-service
route:
- destination:
host: notification-deployment-service.uat-aus.svc.cluster.local
port:
number: 8088
timeout: 30s