diff --git a/content/docs/tasks/telemetry/gateways/index.md b/content/docs/tasks/telemetry/gateways/index.md
new file mode 100644
index 0000000000..bbedd2fdb8
--- /dev/null
+++ b/content/docs/tasks/telemetry/gateways/index.md
@@ -0,0 +1,640 @@
+---
+title: Remotely Accessing Telemetry Addons
+description: This task shows you how to configure external access to the set of Istio telemetry addons.
+weight: 99
+keywords: [telemetry,gateway,jaeger,zipkin,tracing,kiali,prometheus,addons]
+---
+
+This task shows how to configure Istio to expose and access the telemetry addons outside of
+a cluster.
+
+## Configuring remote access
+
+Remote access to the telemetry addons can be configured in a number of different ways. This task covers
+two basic access methods: secure (via HTTPS) and insecure (via HTTP). The secure method is *strongly
+recommended* for any production or sensitive environment. Insecure access is simpler to set up, but
+will not protect any credentials or data transmitted outside of your cluster.
+
+### Option 1: Secure access (HTTPS)
+
+A server certificate is required for secure access. Follow these steps to install and configure
+server certificates for a domain that you control.
+
+You may use self-signed certificates instead. Visit our
+[Securing Gateways with HTTPS Using Secret Discovery Service task](/docs/tasks/traffic-management/secure-ingress/sds/)
+for general information on using self-signed certificates to access in-cluster services.
+
+{{< warning >}}
+This option covers securing the transport layer *only*. You should also configure the telemetry
+addons to require authentication when exposing them externally.
+{{< /warning >}}
+
+1. [Install Istio](/docs/setup/kubernetes) in your cluster and enable the `cert-manager` flag and configure `istio-ingressgateway` to use
+the [Secret Discovery Service](https://www.envoyproxy.io/docs/envoy/latest/configuration/secret#config-secret-discovery-service).
+
+    To install Istio accordingly, use the following Helm installation options:
+
+    * `--set gateways.enabled=true`
+    * `--set gateways.istio-ingressgateway.enabled=true`
+    * `--set gateways.istio-ingressgateway.sds.enabled=true`
+    * `--set certmanager.enabled=true`
+    * `--set certmanager.email=mailbox@donotuseexample.com`
+
+    To additionally install the telemetry addons, use the following Helm installation options:
+
+    * Grafana: `--set grafana.enabled=true`
+    * Kiali: `--set kiali.enabled=true`
+    * Prometheus: `--set prometheus.enabled=true`
+    * Tracing: `--set tracing.enabled=true`
+
+1. Configure the DNS records for your domain.
+
+    1. Get the external IP address of the `istio-ingressgateway`.
+
+        {{< text bash >}}
+        $ kubectl -n istio-system get service istio-ingressgateway -o jsonpath='{.status.loadBalancer.ingress[0].ip}'
+        <IP ADDRESS OF CLUSTER INGRESS>
+        {{< /text >}}
+
+    1. Set an environment variable to hold your target domain.
+
+        {{< text bash >}}
+        $ TELEMETRY_DOMAIN=<your.desired.domain>
+        {{< /text >}}
+
+    1. Point your desired domain at that external IP address via your domain provider.
+
+        The mechanism for achieving this step varies by provider. Here are a few example documentation links:
+
+        * Bluehost: [DNS Management Add Edit or Delete DNS Entries](https://my.bluehost.com/hosting/help/559)
+        * GoDaddy: [Add an A record](https://www.godaddy.com/help/add-an-a-record-19238)
+        * Google Domains: [Resource Records](https://support.google.com/domains/answer/3290350?hl=en)
+        * Name.com: [Adding an A record](https://www.name.com/support/articles/115004893508-Adding-an-A-record)
+
+    1. Verify that the DNS records are correct.
+
+        {{< text bash >}}
+        $ dig +short $TELEMETRY_DOMAIN
+        <IP ADDRESS OF CLUSTER INGRESS>
+        {{< /text >}}
+
+1. Generate a server certificate
+
+    {{< text bash >}}
+    $ cat <<EOF | kubectl apply -f -
+    apiVersion: certmanager.k8s.io/v1alpha1
+    kind: Certificate
+    metadata:
+      name: telemetry-gw-cert
+      namespace: istio-system
+    spec:
+      secretName: telemetry-gw-cert
+      issuerRef:
+        name: letsencrypt
+        kind: ClusterIssuer
+      commonName: $TELEMETRY_DOMAIN
+      dnsNames:
+      - $TELEMETRY_DOMAIN
+      acme:
+        config:
+        - http01:
+            ingressClass: istio
+          domains:
+          - $TELEMETRY_DOMAIN
+    ---
+    EOF
+    certificate.certmanager.k8s.io "telemetry-gw-cert" created
+    {{< /text >}}
+
+1. Wait until the server certificate is ready.
+
+    {{< text bash >}}
+    $ JSONPATH='{range .items[*]}{@.metadata.name}:{range @.status.conditions[*]}{@.type}={@.status}{end}{end}' && kubectl -n istio-system get certificates -o jsonpath="$JSONPATH"
+    telemetry-gw-cert:Ready=True
+    {{< /text >}}
+
+1. Apply networking configuration for the telemetry addons.
+
+    1. Apply the following configuration to expose Grafana:
+
+        {{< text bash >}}
+        $ cat <<EOF | kubectl apply -f -
+        apiVersion: networking.istio.io/v1alpha3
+        kind: Gateway
+        metadata:
+          name: grafana-gateway
+          namespace: istio-system
+        spec:
+          selector:
+            istio: ingressgateway
+          servers:
+          - port:
+              number: 15031
+              name: https-grafana
+              protocol: HTTPS
+            tls:
+              mode: SIMPLE
+              serverCertificate: sds
+              privateKey: sds
+              credentialName: telemetry-gw-cert
+            hosts:
+            - "$TELEMETRY_DOMAIN"
+        ---
+        apiVersion: networking.istio.io/v1alpha3
+        kind: VirtualService
+        metadata:
+          name: grafana-vs
+          namespace: istio-system
+        spec:
+          hosts:
+          - "$TELEMETRY_DOMAIN"
+          gateways:
+          - grafana-gateway
+          http:
+          - match:
+            - port: 15031
+            route:
+            - destination:
+                host: grafana
+                port:
+                  number: 3000
+        ---
+        apiVersion: networking.istio.io/v1alpha3
+        kind: DestinationRule
+        metadata:
+          name: grafana
+          namespace: istio-system
+        spec:
+          host: grafana
+          trafficPolicy:
+            tls:
+              mode: DISABLE
+        ---
+        EOF
+        gateway.networking.istio.io "grafana-gateway" configured
+        virtualservice.networking.istio.io "grafana-vs" configured
+        destinationrule.networking.istio.io "grafana" configured
+        {{< /text >}}
+
+    1. Apply the following configuration to expose Kiali:
+
+        {{< text bash >}}
+        $ cat <<EOF | kubectl apply -f -
+        apiVersion: networking.istio.io/v1alpha3
+        kind: Gateway
+        metadata:
+          name: kiali-gateway
+          namespace: istio-system
+        spec:
+          selector:
+            istio: ingressgateway
+          servers:
+          - port:
+              number: 15029
+              name: https-kiali
+              protocol: HTTPS
+            tls:
+              mode: SIMPLE
+              serverCertificate: sds
+              privateKey: sds
+              credentialName: telemetry-gw-cert
+            hosts:
+            - "$TELEMETRY_DOMAIN"
+        ---
+        apiVersion: networking.istio.io/v1alpha3
+        kind: VirtualService
+        metadata:
+          name: kiali-vs
+          namespace: istio-system
+        spec:
+          hosts:
+          - "$TELEMETRY_DOMAIN"
+          gateways:
+          - kiali-gateway
+          http:
+          - match:
+            - port: 15029
+            route:
+            - destination:
+                host: kiali
+                port:
+                  number: 20001
+        ---
+        apiVersion: networking.istio.io/v1alpha3
+        kind: DestinationRule
+        metadata:
+          name: kiali
+          namespace: istio-system
+        spec:
+          host: kiali
+          trafficPolicy:
+            tls:
+              mode: DISABLE
+        ---
+        EOF
+        gateway.networking.istio.io "kiali-gateway" configured
+        virtualservice.networking.istio.io "kiali-vs" configured
+        destinationrule.networking.istio.io "kiali" configured
+        {{< /text >}}
+
+    1. Apply the following configuration to expose Prometheus:
+
+        {{< text bash >}}
+        $ cat <<EOF | kubectl apply -f -
+        apiVersion: networking.istio.io/v1alpha3
+        kind: Gateway
+        metadata:
+          name: prometheus-gateway
+          namespace: istio-system
+        spec:
+          selector:
+            istio: ingressgateway
+          servers:
+          - port:
+              number: 15030
+              name: https-prom
+              protocol: HTTPS
+            tls:
+              mode: SIMPLE
+              serverCertificate: sds
+              privateKey: sds
+              credentialName: telemetry-gw-cert
+            hosts:
+            - "$TELEMETRY_DOMAIN"
+        ---
+        apiVersion: networking.istio.io/v1alpha3
+        kind: VirtualService
+        metadata:
+          name: prometheus-vs
+          namespace: istio-system
+        spec:
+          hosts:
+          - "$TELEMETRY_DOMAIN"
+          gateways:
+          - prometheus-gateway
+          http:
+          - match:
+            - port: 15030
+            route:
+            - destination:
+                host: prometheus
+                port:
+                  number: 9090
+        ---
+        apiVersion: networking.istio.io/v1alpha3
+        kind: DestinationRule
+        metadata:
+          name: prometheus
+          namespace: istio-system
+        spec:
+          host: prometheus
+          trafficPolicy:
+            tls:
+              mode: DISABLE
+        ---
+        EOF
+        gateway.networking.istio.io "prometheus-gateway" configured
+        virtualservice.networking.istio.io "prometheus-vs" configured
+        destinationrule.networking.istio.io "prometheus" configured
+        {{< /text >}}
+
+    1. Apply the following configuration to expose the tracing service:
+
+        {{< text bash >}}
+        $ cat <<EOF | kubectl apply -f -
+        apiVersion: networking.istio.io/v1alpha3
+        kind: Gateway
+        metadata:
+          name: tracing-gateway
+          namespace: istio-system
+        spec:
+          selector:
+            istio: ingressgateway
+          servers:
+          - port:
+              number: 15032
+              name: https-tracing
+              protocol: HTTPS
+            tls:
+              mode: SIMPLE
+              serverCertificate: sds
+              privateKey: sds
+              credentialName: telemetry-gw-cert
+            hosts:
+            - "$TELEMETRY_DOMAIN"
+        ---
+        apiVersion: networking.istio.io/v1alpha3
+        kind: VirtualService
+        metadata:
+          name: tracing-vs
+          namespace: istio-system
+        spec:
+          hosts:
+          - "$TELEMETRY_DOMAIN"
+          gateways:
+          - tracing-gateway
+          http:
+          - match:
+            - port: 15032
+            route:
+            - destination:
+                host: tracing
+                port:
+                  number: 80
+        ---
+        apiVersion: networking.istio.io/v1alpha3
+        kind: DestinationRule
+        metadata:
+          name: tracing
+          namespace: istio-system
+        spec:
+          host: tracing
+          trafficPolicy:
+            tls:
+              mode: DISABLE
+        ---
+        EOF
+        gateway.networking.istio.io "tracing-gateway" configured
+        virtualservice.networking.istio.io "tracing-vs" configured
+        destinationrule.networking.istio.io "tracing" configured
+        {{< /text >}}
+
+1. Visit the telemetry addons via your browser.
+
+    * Kiali: `https://$TELEMETRY_DOMAIN:15029/`
+    * Prometheus: `https://$TELEMETRY_DOMAIN:15030/`
+    * Grafana: `https://$TELEMETRY_DOMAIN:15031/`
+    * Tracing: `https://$TELEMETRY_DOMAIN:15032/`
+
+### Option 2: Insecure access (HTTP)
+
+1. [Install Istio](/docs/setup/) in your cluster with your desired telemetry addons.
+
+    To additionally install the telemetry addons, use the following Helm installation options:
+
+    * Grafana: `--set grafana.enabled=true`
+    * Kiali: `--set kiali.enabled=true`
+    * Prometheus: `--set prometheus.enabled=true`
+    * Tracing: `--set tracing.enabled=true`
+
+1. Apply networking configuration for the telemetry addons.
+
+    1. Apply the following configuration to expose Grafana:
+
+        {{< text bash >}}
+        $ cat <<EOF | kubectl apply -f -
+        apiVersion: networking.istio.io/v1alpha3
+        kind: Gateway
+        metadata:
+          name: grafana-gateway
+          namespace: istio-system
+        spec:
+          selector:
+            istio: ingressgateway
+          servers:
+          - port:
+              number: 15031
+              name: http-grafana
+              protocol: HTTP
+            hosts:
+            - "*"
+        ---
+        apiVersion: networking.istio.io/v1alpha3
+        kind: VirtualService
+        metadata:
+          name: grafana-vs
+          namespace: istio-system
+        spec:
+          hosts:
+          - "*"
+          gateways:
+          - grafana-gateway
+          http:
+          - match:
+            - port: 15031
+            route:
+            - destination:
+                host: grafana
+                port:
+                  number: 3000
+        ---
+        apiVersion: networking.istio.io/v1alpha3
+        kind: DestinationRule
+        metadata:
+          name: grafana
+          namespace: istio-system
+        spec:
+          host: grafana
+          trafficPolicy:
+            tls:
+              mode: DISABLE
+        ---
+        EOF
+        gateway.networking.istio.io "grafana-gateway" configured
+        virtualservice.networking.istio.io "grafana-vs" configured
+        destinationrule.networking.istio.io "grafana" configured
+        {{< /text >}}
+
+    1. Apply the following configuration to expose Kiali:
+
+        {{< text bash >}}
+        $ cat <<EOF | kubectl apply -f -
+        apiVersion: networking.istio.io/v1alpha3
+        kind: Gateway
+        metadata:
+          name: kiali-gateway
+          namespace: istio-system
+        spec:
+          selector:
+            istio: ingressgateway
+          servers:
+          - port:
+              number: 15029
+              name: http-kiali
+              protocol: HTTP
+            hosts:
+            - "*"
+        ---
+        apiVersion: networking.istio.io/v1alpha3
+        kind: VirtualService
+        metadata:
+          name: kiali-vs
+          namespace: istio-system
+        spec:
+          hosts:
+          - "*"
+          gateways:
+          - kiali-gateway
+          http:
+          - match:
+            - port: 15029
+            route:
+            - destination:
+                host: kiali
+                port:
+                  number: 20001
+        ---
+        apiVersion: networking.istio.io/v1alpha3
+        kind: DestinationRule
+        metadata:
+          name: kiali
+          namespace: istio-system
+        spec:
+          host: kiali
+          trafficPolicy:
+            tls:
+              mode: DISABLE
+        ---
+        EOF
+        gateway.networking.istio.io "kiali-gateway" configured
+        virtualservice.networking.istio.io "kiali-vs" configured
+        destinationrule.networking.istio.io "kiali" configured
+        {{< /text >}}
+
+    1. Apply the following configuration to expose Prometheus:
+
+        {{< text bash >}}
+        $ cat <<EOF | kubectl apply -f -
+        apiVersion: networking.istio.io/v1alpha3
+        kind: Gateway
+        metadata:
+          name: prometheus-gateway
+          namespace: istio-system
+        spec:
+          selector:
+            istio: ingressgateway
+          servers:
+          - port:
+              number: 15030
+              name: http-prom
+              protocol: HTTP
+            hosts:
+            - "*"
+        ---
+        apiVersion: networking.istio.io/v1alpha3
+        kind: VirtualService
+        metadata:
+          name: prometheus-vs
+          namespace: istio-system
+        spec:
+          hosts:
+          - "*"
+          gateways:
+          - prometheus-gateway
+          http:
+          - match:
+            - port: 15030
+            route:
+            - destination:
+                host: prometheus
+                port:
+                  number: 9090
+        ---
+        apiVersion: networking.istio.io/v1alpha3
+        kind: DestinationRule
+        metadata:
+          name: prometheus
+          namespace: istio-system
+        spec:
+          host: prometheus
+          trafficPolicy:
+            tls:
+              mode: DISABLE
+        ---
+        EOF
+        gateway.networking.istio.io "prometheus-gateway" configured
+        virtualservice.networking.istio.io "prometheus-vs" configured
+        destinationrule.networking.istio.io "prometheus" configured
+        {{< /text >}}
+
+    1. Apply the following configuration to expose the tracing service:
+
+        {{< text bash >}}
+        $ cat <<EOF | kubectl apply -f -
+        apiVersion: networking.istio.io/v1alpha3
+        kind: Gateway
+        metadata:
+          name: tracing-gateway
+          namespace: istio-system
+        spec:
+          selector:
+            istio: ingressgateway
+          servers:
+          - port:
+              number: 15032
+              name: http-tracing
+              protocol: HTTP
+            hosts:
+            - "*"
+        ---
+        apiVersion: networking.istio.io/v1alpha3
+        kind: VirtualService
+        metadata:
+          name: tracing-vs
+          namespace: istio-system
+        spec:
+          hosts:
+          - "*"
+          gateways:
+          - tracing-gateway
+          http:
+          - match:
+            - port: 15032
+            route:
+            - destination:
+                host: tracing
+                port:
+                  number: 80
+        ---
+        apiVersion: networking.istio.io/v1alpha3
+        kind: DestinationRule
+        metadata:
+          name: tracing
+          namespace: istio-system
+        spec:
+          host: tracing
+          trafficPolicy:
+            tls:
+              mode: DISABLE
+        ---
+        EOF
+        gateway.networking.istio.io "tracing-gateway" configured
+        virtualservice.networking.istio.io "tracing-vs" configured
+        destinationrule.networking.istio.io "tracing" configured
+        {{< /text >}}
+
+1. Visit the telemetry addons via your browser.
+
+    * Kiali: `http://<IP ADDRESS OF CLUSTER INGRESS>:15029/`
+    * Prometheus: `http://<IP ADDRESS OF CLUSTER INGRESS>:15030/`
+    * Grafana: `http://<IP ADDRESS OF CLUSTER INGRESS>:15031/`
+    * Tracing: `http://<IP ADDRESS OF CLUSTER INGRESS>:15032/`
+
+## Cleanup
+
+* Remove all related Gateways:
+
+    {{< text bash >}}
+    $ kubectl -n istio-system delete gateway grafana-gateway kiali-gateway prometheus-gateway tracing-gateway
+    gateway.networking.istio.io "grafana-gateway" deleted
+    gateway.networking.istio.io "kiali-gateway" deleted
+    gateway.networking.istio.io "prometheus-gateway" deleted
+    gateway.networking.istio.io "tracing-gateway" deleted
+    {{< /text >}}
+
+* Remove all related Virtual Services:
+
+    {{< text bash >}}
+    $ kubectl -n istio-system delete virtualservice grafana-vs kiali-vs prometheus-vs tracing-vs
+    virtualservice.networking.istio.io "grafana-vs" deleted
+    virtualservice.networking.istio.io "kiali-vs" deleted
+    virtualservice.networking.istio.io "prometheus-vs" deleted
+    virtualservice.networking.istio.io "tracing-vs" deleted
+    {{< /text >}}
+
+* If installed, remove the gateway certificate:
+
+    {{< text bash >}}
+    $ kubectl -n istio-system delete certificate telemetry-gw-cert
+    certificate.certmanager.k8s.io "telemetry-gw-cert" deleted
+    {{< /text >}}
\ No newline at end of file