How to make harbor reachable behind istio ingress?

I have installed Harbor as follows:

helm install hub harbor/harbor \
  --version 1.3.2 \
  --namespace tool \
  --set expose.ingress.hosts.core=hub.service.example.io \
  --set expose.ingress.annotations.'kubernetes\.io/ingress\.class'=istio \
  --set expose.ingress.annotations.'cert-manager\.io/cluster-issuer'=letsencrypt-prod \
  --set externalURL=https://hub.service.example.io \
  --set notary.enabled=false \
  --set secretkey=secret \
  --set harborAdminPassword=pw

Everything is up and running but the page is not reachable via https://hub.service.example.io. The same problem occurs here Why css and png are not accessible? but how to set wildcard * in Helm?

Update

Istio supports ingress gateway. This for example works without Gateway and VirtualService definition:

apiVersion: v1
kind: Service
metadata:
  name: hello-kubernetes-first
spec:
  type: ClusterIP
  ports:
    - port: 80
      targetPort: 8080
  selector:
    app: hello-kubernetes-first
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: hello-kubernetes-first
spec:
  replicas: 3
  selector:
    matchLabels:
      app: hello-kubernetes-first
  template:
    metadata:
      labels:
        app: hello-kubernetes-first
    spec:
      containers:
        - name: hello-kubernetes
          image: paulbouwer/hello-kubernetes:1.8
          ports:
            - containerPort: 8080
          env:
            - name: MESSAGE
              value: Hello from the first deployment!
---
apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  annotations:
    kubernetes.io/ingress.class: istio
  name: helloworld-ingress
spec:
  rules:
    - host: "hw.service.example.io"
      http:
        paths:
          - path: "/*"
            backend:
              serviceName: hello-kubernetes-first
              servicePort: 80
---

Solution

I would say it won't work with ingress and istio.

As mentioned here

Simple ingress specifications, with host, TLS, and exact path based matches will work out of the box without the need for route rules. However, note that the path used in the ingress resource should not have any . characters.

For example, the following ingress resource matches requests for the example.com host, with /helloworld as the URL.

$ kubectl create -f - <<EOF
apiVersion: extensions/v1beta1
kind: Ingress
metadata:
name: simple-ingress
annotations:
  kubernetes.io/ingress.class: istio
spec:
rules:
- host: example.com
  http:
    paths:
    - path: /helloworld
      backend:
        serviceName: myservice
        servicePort: grpc
EOF

However, the following rules will not work because they use regular expressions in the path and ingress.kubernetes.io annotations:

$ kubectl create -f - <<EOF
apiVersion: extensions/v1beta1
kind: Ingress
metadata:
name: this-will-not-work
annotations:
  kubernetes.io/ingress.class: istio
  # Ingress annotations other than ingress class will not be honored
  ingress.kubernetes.io/rewrite-target: /
spec:
rules:
- host: example.com
  http:
    paths:
    - path: /hello(.*?)world/
      backend:
        serviceName: myservice
        servicePort: grpc
EOF

I assume your hello-world is working because of just 1 annotation which is ingress class.

If you take a look at annotations of harbor here, it might be the problem when you want to use ingress with istio.

but how to set wildcard * in Helm?

Wildcard have nothing to do here. As I mentioned in this answer you can use either wildcard or additional paths, which is done well. Take a look at the ingress paths here.