apiVersion: v1
kind: Service
metadata:
  annotations: null
  labels:
    app: istio-egressgateway
    install.operator.istio.io/owning-resource: unknown
    istio: egressgateway
    istio.io/rev: default
    operator.istio.io/component: EgressGateways
    release: istio
  name: istio-egressgateway
  namespace: istio-system
spec:
  ports:
  - name: http2
    port: 80
    protocol: TCP
    targetPort: 8080
  - name: https

kind: Deployment
metadata:
  labels:
    app: istio-egressgateway
    install.operator.istio.io/owning-resource: unknown
    istio: egressgateway
    istio.io/rev: default
    operator.istio.io/component: EgressGateways
    release: istio
  name: istio-egressgateway
  namespace: istio-system
spec:
  selector:
    matchLabels:
      app: istio-egressgateway
      istio: egressgateway
  strategy:
    rollingUpdate:

      enabled: true
    cni:
      enabled: false
    egressGateways:
    - enabled: false
      name: istio-egressgateway
    ingressGateways:
    - enabled: true
      name: istio-ingressgateway
    pilot:
      enabled: false
  hub: gcr.io/istio-testing

  profile: default
  tag: latest
  values:
    defaultRevision: ""
    gateways:
      istio-egressgateway: {}
      istio-ingressgateway: {}
    global:

  gateways:
  - mesh
  tcp:
  - match:
    - port: {{ .externalSvcTcpPort }}
    route:
    - destination:
        host: {{ .EgressGatewayServiceName | default "istio-egressgateway" }}.{{ .EgressGatewayServiceNamespace | default "istio-system" }}.svc.cluster.local
        port:
          number: 80
  tls:
  - match:
    - port: {{ .externalSvcTlsPort }}
      sniHosts:

apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: {{ .EgressGatewayIstioLabel | default "egressgateway" }}
  namespace: {{ .EgressGatewayServiceNamespace | default .SystemNamespace.Name }}
spec:
  selector:
    matchLabels:
      app: {{ .EgressGatewayServiceName | default "istio-egressgateway" }}
  rules:
    - to: # only allow /allow for company.com
        - operation:
            paths: [ "/allow" ]

components.base.enabled=true
components.cni.enabled=false
components.egressGateways[0].enabled=false
components.egressGateways[0].name="istio-egressgateway"
components.ingressGateways[0].enabled=true
components.ingressGateways[0].name="istio-ingressgateway"
components.pilot.enabled=false
hub="gcr.io/istio-testing"
profile="default"
tag="latest"
values.defaultRevision=""
values.global.configValidation=true

  components:
    base:
      enabled: true
    pilot:
      enabled: true
    # Istio Gateway feature
    ingressGateways:
    - name: istio-ingressgateway
      enabled: true
    egressGateways:
    - name: istio-egressgateway
      enabled: false

  # Most default values come from the helm chart's values.yaml
  # Below are the things that differ
  values:
    defaultRevision: ""
    global:

	if cfg == nil {
		return
	}
	cfg.ControlPlaneValues = tmpl.MustEvaluate(`
{{- if not .isExternalControlPlane }}
components:
  egressGateways:
  - enabled: true
    name: istio-egressgateway
values:
   gateways:
      istio-egressgateway:
         secretVolumes:
         - name: client-custom-certs
           secretName: egress-gw-cacerts
           mountPath: /etc/certs/custom
{{- end }}

[0].mountPath="/etc/istio/egressgateway-certs"

apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: {{ .EgressGatewayServiceName | default "istio-egressgateway" }}
spec:
  selector:
    istio: {{ .EgressGatewayIstioLabel | default "egressgateway" }}
  servers:
  - port:
      number: 80
      name: http
      protocol: TLS
    hosts:
    - external.{{ .externalNamespace }}.svc.cluster.local
    tls:
      mode: ISTIO_MUTUAL
  - port:
      number: 443