AWS External Load Balancer TLS Termination - generate 443 server rules when `default-external-scheme: https` is set about serving

[skonto]

I would expect that the 443 rule would be added to the gateway when default-external-scheme: https is set, or another option would exist to specify that the rule should be added.

cc @ReToCode may have to add more.

[ReToCode]

I don't think this is a from us supported scenario.

Knative itself can provide TLS on external domains in it's ingress layer. Assuming istio you can put a TLS certificate on istio using this guide: https://knative.dev/docs/serving/encryption/external-domain-tls/#obtaining-a-certificate-using-a-tool (check the istio tab). If now your LB does another TLS termination, you have to make sure that the LB connects using https to the TLS cert that you put in the istio gateway and that your AWS LB trusts that certificate somehow.

[patrickleet]

It seems like the easiest place to make this work would be knative, to allow a user to customize the gateway that's generated by knative - it's something that's already done using autoTLS, I just want that same logic but without a cert specified. It's a lot of effort for all the workarounds.