Istio gateway tls not working http_code 520 [istio]

Networking
1

i’m new on istio, i have a problem with istio tls configuration gateway. i use aws eks service and dns cloudflare with auto ttl

this is my ingress gateway

apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: gateway
  namespace: production
spec:
  selector:
    istio: ingressgateway # use Istio default gateway implementation
  servers:
  - port:
      number: 443
      name: https
      protocol: HTTPS
    hosts:
    - k8s.test.com
    tls:
      mode: PASSTHROUGH

this is my VirtualService:

apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: virtualservice
  namespace: production
spec:
  hosts:
  - k8s.test.com
  gateways:
  - gateway
  tls:
  - match:
    - sniHosts:
      - k8s.test.com
    route:
    - destination:
        host: myservice-clusterip-prod
        port:
          number: 9080

the browser show me http_code 520 !!!