- match:
        - gateways:
            - test-egress
          port: 80
      route:
        - destination:
            host: "{{ .To.ClusterLocalFQDN }}"
            port:
              number: {{ (.To.PortForName "http").ServicePort }}
          weight: 100
      headers:
        request:
          add:
            x-egress-test: "handled-by-egress-gateway"
---
apiVersion: networking.istio.io/v1beta1

apiVersion: networking.istio.io/v1beta1
kind: ServiceEntry
metadata:
  name: egress
spec:
  hosts:
  - "google.com"
  - "*.egress.com"
  ports:
  - number: 80
    name: http
    protocol: HTTP
  - number: 443
    name: tls
    protocol: TLS
---
apiVersion: gateway.networking.k8s.io/v1beta1
kind: HTTPRoute
metadata:
  name: egress
  namespace: default
spec:
  parentRefs:
  - kind: ServiceEntry

kind: VirtualService
metadata:
  annotations:
    internal.istio.io/parents: HTTPRoute/egress.default
    internal.istio.io/route-semantics: gateway
  creationTimestamp: null
  name: egress-1-istio-autogenerated-k8s-gateway
  namespace: default
spec:
  gateways:
  - mesh
  hosts:
  - '*.egress.com'
  http:
  - name: default.egress.0
    route:
    - destination:
        host: google.com
        port:

		},
	}

	ingress.Ports = ports
	egress.Ports = ports

	if hasEndPort {
		ingress.Ports[0].EndPort = &endPort
		egress.Ports[0].EndPort = &endPort
	}

	if isIngress {
		netPol.Spec.Ingress = append(netPol.Spec.Ingress, ingress)
	}

	if isEgress {
		netPol.Spec.Egress = append(netPol.Spec.Egress, egress)
	}

	return netPol
}

4) `gateways` charts install a load balancer with `ingress` and `egress`.

Ingress secrets and access should be separated from the control plane.

```console
helm install -n istio-system istio-ingress manifests/charts/gateways/istio-ingress --set profile=openshift
```

Egress secrets and access should be separated from the control plane.

```console

  namespace: ns1
spec:
  egress:
  - hosts:
    - "./*"
---
apiVersion: networking.istio.io/v1alpha3
kind: Sidecar
metadata:
  name: has-selector
  namespace: ns1
spec:
  workloadSelector: # Since this has a workload selector, it shouldn't conflict with the other Sidecar in the namespace
    labels:
      app: foo
  egress:
  - hosts:
    - "./*"
---

    controllerName: istio.io/gateway-controller
    parentRef:
      group: networking.istio.io
      kind: ServiceEntry
      name: egress
---
apiVersion: gateway.networking.k8s.io/v1alpha2
kind: TCPRoute
metadata:
  creationTimestamp: null
  name: egress
  namespace: default
spec: null
status:
  parents:
  - conditions:
    - lastTransitionTime: fake
      message: Route was valid

				StatusCode: http.StatusOK,
				Protocol:   "HTTP/1.1",
				RequestHeaders: map[string]string{
					// We inject this header in the VirtualService
					"Handled-By-Egress-Gateway": "true",
				},
			},
		},
		{
			Name:     "HTTP H2 Traffic Egress",
			PortName: "http",
			HTTP2:    true,
			Host:     "some-external-site.com",
			Expected: Expected{
				Query: prometheus.Query{

See [the Egress Task](https://istio.io/docs/tasks/traffic-management/egress/) for
information on configuring Istio to contact external services.

This directory contains samples showing how to enable pods to contact a few well
known services.

### Examples

#### Egress Gateway

Deploying a Gateway to be used as an [Egress Gateway](https://istio.io/latest/docs/tasks/traffic-management/egress/egress-gateway/):

```yaml
service:
  # Egress gateways do not need an external LoadBalancer IP
  type: ClusterIP
```

#### Multi-network/VM Gateway