apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
  name: db-tls
spec:
  host: mydbserver.prod.svc.cluster.local
  trafficPolicy:
    tls:
      mode: SIMPLE

metadata:
  name: db-tls
spec:
  host: mydbserver.prod.svc.cluster.local
  trafficPolicy:
    portLevelSettings:
      - port:
          number: 443
        tls:
          mode: SIMPLE

apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
  name: db-tls
spec:
  host: mydbserver.prod.svc.cluster.local
  trafficPolicy:
    tls:
      mode: SIMPLE
      credentialName: db-credential
  workloadSelector:
      matchLabels:

metadata:
  name: db-tls
spec:
  host: mydbserver.prod.svc.cluster.local
  trafficPolicy:
    portLevelSettings:
      - port:
          number: 443
        tls:
          mode: SIMPLE
          credentialName: db-credential
  workloadSelector:
      matchLabels:

	}
}

func haveSameCertificate(currentGatewayTLS, gatewayTLS *v1alpha3.ServerTLSSettings) bool {
	if currentGatewayTLS.CredentialName != "" && gatewayTLS.CredentialName != "" {
		return currentGatewayTLS.CredentialName == gatewayTLS.CredentialName
	}

	if currentGatewayTLS.CredentialName == "" && gatewayTLS.CredentialName == "" {
		if currentGatewayTLS.ServerCertificate != "" && gatewayTLS.ServerCertificate != "" {

  namespace: istio-system
spec:
  selector:
    istio: ingressgateway
  servers:
  - port:
      number: 443
      name: https
      protocol: HTTPS
    tls:
      mode: SIMPLE
      credentialName: "test-01-wildcard-cert" # validation error since have same certificate with gateway-02-test-01
    hosts:
    - "01.test-01.com"
---
apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:

  - port:
      number: 443
      name: https
      protocol: HTTPS
    tls:
      mode: SIMPLE
      credentialName: "httpbin-credential"
    hosts:
    - "httpbin.example.com"
---
apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: defaultgateway-nocredential # No credentialName specified, we shouldn't generate any errors
spec:
  selector:
    istio: ingressgateway
  servers:
  - port:

        # use a valid credential here
        credentialName: "$CREDENTIAL_NAME"
      hosts:
      # use a valid gateway host and domain for istiod
      - "ISTIOD-HOST.DOMAIN"
    - port:
        name: https-istiodwebhook
        number: 15017
        protocol: https
      tls:
        mode: SIMPLE
        # use a valid credential here
        credentialName: "$CREDENTIAL_NAME"
      hosts:

  servers:
    - port:
        number: 443
        name: https
        protocol: HTTPS
      tls:
        mode: SIMPLE
        credentialName: "invalid-key" # wrong key names, should have one error
      hosts:
        - "httpbin.example.com"
---
apiVersion: v1
data:
  tls.cert: aHVzaCBodXNoIGh1c2gK
kind: Secret
metadata:
  name: missing-key

kind: bug-fix
area: traffic-management
releaseNotes:
- |
  **Fixed** an issue where using `ISTIO_MUTUAL` TLS mode in Gateways while also setting `credentialName` cause mutual TLS to not be configured.
  This configuration is now rejected, as `ISTIO_MUTUAL` is intended to be used without `credentialName` set.