CANONICAL_REVISION='latest'
CANONICAL_SERVICE='foo'
ISTIO_INBOUND_PORTS='*'
ISTIO_LOCAL_EXCLUDE_PORTS='22,15090,15021,15020'
ISTIO_METAJSON_LABELS='{"service.istio.io/canonical-name":"foo","service.istio.io/canonical-revision":"latest"}'
ISTIO_META_CLUSTER_ID='Kubernetes'
ISTIO_META_DNS_CAPTURE='true'
ISTIO_META_MESH_ID=''
ISTIO_META_NETWORK=''
ISTIO_META_WORKLOAD_NAME='foo'
ISTIO_NAMESPACE='bar'
ISTIO_SERVICE='foo.bar'
ISTIO_SERVICE_CIDR='*'

CANONICAL_REVISION='latest'
CANONICAL_SERVICE='foo'
CA_ADDR='istiod-rev-1.istio-system.svc:15012'
CLUSTER_MESH_CONFIG_VALUE='foo'
ISTIO_INBOUND_PORTS='*'
ISTIO_LOCAL_EXCLUDE_PORTS='22,15090,15021,15020'
ISTIO_METAJSON_LABELS='{"service.istio.io/canonical-name":"foo","service.istio.io/canonical-revision":"latest"}'
ISTIO_META_CLUSTER_ID='Kubernetes'
ISTIO_META_DNS_CAPTURE='true'
ISTIO_META_MESH_ID=''
ISTIO_META_NETWORK=''
ISTIO_META_WORKLOAD_NAME='foo'

  // Un-prefixed names are reserved for IANA standard service names (as per
  // RFC-6335 and https://www.iana.org/assignments/service-names).
  // Non-standard protocols should use prefixed names such as
  // mycompany.com/my-custom-protocol.
  // +optional
  optional string appProtocol = 4;
}

// EndpointSlice represents a subset of the endpoints that implement a service.

NAME     VHOST NAME     DOMAINS     MATCH                  VIRTUAL SERVICE
         backend        *           /healthz/ready*        

defaultConfig:
  proxyMetadata:
    CANONICAL_REVISION: latest
    CANONICAL_SERVICE: foo
    ISTIO_META_CLUSTER_ID: Kubernetes
    ISTIO_META_DNS_CAPTURE: "true"
    ISTIO_META_MESH_ID: ""
    ISTIO_META_NETWORK: ""
    ISTIO_META_WORKLOAD_NAME: foo
    ISTIO_METAJSON_LABELS: '{"service.istio.io/canonical-name":"foo","service.istio.io/canonical-revision":"latest"}'
    POD_NAMESPACE: bar
    SERVICE_ACCOUNT: vm-serviceaccount
    TRUST_DOMAIN: ""

// +structType=atomic
message EndpointPort {
  // name represents the name of this port. All ports in an EndpointSlice must have a unique name.
  // If the EndpointSlice is dervied from a Kubernetes service, this corresponds to the Service.ports[].name.
  // Name must either be an empty string or pass DNS_LABEL validation:
  // * must be no more than 63 characters long.
  // * must consist of lower case alphanumeric characters or '-'.

NAME          VHOST NAME                 DOMAINS                 MATCH                  VIRTUAL SERVICE
http.8080     httpbin.example.com:80     httpbin.example.com     /get*                  httpbin.default
              backend                    *                       /stats/prometheus*     

config for the rest.

All internal services ( telemetry, pilot debug ports, mesh expansion ) can now be configured via the new mechanism.

# Migration from istio-system

Istio 1.0 includes the gateways in istio-system. Since the external IP is associated
with the Service and bound to the namespace, it is recommended to:

1. Install the new gateway in a new namespace.

contexts:
- context:
    cluster: local
    user: istio-cni
  name: istio-cni-context
current-context: istio-cni-context
kind: Config
preferences: {}
users:
- name: istio-cni
  user:

NAME        VHOST NAME                 DOMAINS                 MATCH                  VIRTUAL SERVICE
http.80     httpbin.example.com:80     httpbin.example.com     PathPrefix:/get        http-0-istio-autogenerated-k8s-gateway.default
            backend                    *                       /healthz/ready*