I am trying to switch from an nginx Ingress to using Istio to take advantage of route weights for canary deployments, and integrated monitoring, among other things.

My regular routing was defined as:

apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: solar-demo
  annotations:
    nginx.org/server-snippet: "proxy_ssl_verify off;"
spec:
  rules:
  - host: shmukler.example.com
    http:
      paths:
      - path: /city/*
        backend:
          serviceName: solar-demo
          servicePort: 3000
      - path: /solar/*
        backend:
          serviceName: solar-demo
          servicePort: 3001
--
kind: Service
apiVersion: v1
metadata:
  name: solar-demo
spec:
  ports:
  - name: city
    protocol: TCP
    port: 3000
    targetPort: 3000
  - name: solar
    protocol: TCP
    port: 3001
    targetPort: 3001
  selector:
    app: solar-demo

I don't even need auth, right now. When I started install/kubernetes/istio-demo.yaml, it created a bunch of pods and services in the istio-system namespace.

I figured, possibly incorrectly, that I need to have a VirtualService and maybe route rules defined. Wrote:

apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: solar-demo
spec:
  hosts:
    - shmukler.example.com
  http:
  - route:
    - destination:
        host: shmukler.example.com
        subset: blue
      weight: 90
    - destination:
        host: shmukler.example.com
        subset: green
      weight: 10

Are ports defined in the regular service, while weights and paths in a VirtualService? Do I need to stick anything into the istio-system namespace? Is it possible, and what would I need to extend istio-demo.yaml to do the routing, I need, just to get the things rolling?

Any pointers are appreciated.