- match:
        - gateways:
            - test-egress
          port: 80
      route:
        - destination:
            host: "{{ .To.ClusterLocalFQDN }}"
            port:
              number: {{ (.To.PortForName "http").ServicePort }}
          weight: 100
      headers:
        request:
          add:
            x-egress-test: "handled-by-egress-gateway"
---
apiVersion: networking.istio.io/v1beta1

apiVersion: release-notes/v2
kind: feature
area: traffic-management
releaseNotes:
   - |
     **Added** the ability to set credentialName based secret configuration
     at sidecars for egress TLS traffic when WorkloadSelector is specified in `DestinationRule`,
     provided the sidecar has permission to list secrets in the namespace where it resides.
docs:

Vadim Eisenberg <******@****.***> 1558544845 +0300

apiVersion: networking.istio.io/v1beta1
kind: ServiceEntry
metadata:
  name: egress
spec:
  hosts:
  - "google.com"
  - "*.egress.com"
  ports:
  - number: 80
    name: http
    protocol: HTTP
  - number: 443
    name: tls
    protocol: TLS
---
apiVersion: gateway.networking.k8s.io/v1beta1
kind: HTTPRoute
metadata:
  name: egress
  namespace: default
spec:
  parentRefs:
  - kind: ServiceEntry

  egress:
  - hosts:
    - "./*"
---
apiVersion: networking.istio.io/v1alpha3
kind: Sidecar
metadata:
  name: maps-to-nonexistent
  namespace: default
spec:
  workloadSelector:
    labels:
      app: bogus # This doesn't exist, and should generate an error
  egress:
  - hosts:
    - "./*"
---
apiVersion: networking.istio.io/v1alpha3

kind: VirtualService
metadata:
  annotations:
    internal.istio.io/parents: HTTPRoute/egress.default
    internal.istio.io/route-semantics: gateway
  creationTimestamp: null
  name: egress-1-istio-autogenerated-k8s-gateway
  namespace: default
spec:
  gateways:
  - mesh
  hosts:
  - '*.egress.com'
  http:
  - name: default.egress.0
    route:
    - destination:
        host: google.com
        port:

		},
	}

	ingress.Ports = ports
	egress.Ports = ports

	if hasEndPort {
		ingress.Ports[0].EndPort = &endPort
		egress.Ports[0].EndPort = &endPort
	}

	if isIngress {
		netPol.Spec.Ingress = append(netPol.Spec.Ingress, ingress)
	}

	if isEgress {
		netPol.Spec.Egress = append(netPol.Spec.Egress, egress)
	}

	return netPol
}

	if o == nil {
		return
	}

	fs.StringVar(&o.ConfigFile, "egress-selector-config-file", o.ConfigFile,
		"File with apiserver egress selector configuration.")
}

// ApplyTo adds the egress selector settings to the server configuration.
// In case egress selector settings were not provided by a cluster-admin
// they will be prepared from the recommended/default/no-op values.

4) `gateways` charts install a load balancer with `ingress` and `egress`.

Ingress secrets and access should be separated from the control plane.

```console
helm install -n istio-system istio-ingress manifests/charts/gateways/istio-ingress --set profile=openshift
```

Egress secrets and access should be separated from the control plane.

```console

  namespace: ns1
spec:
  egress:
  - hosts:
    - "./*"
---
apiVersion: networking.istio.io/v1alpha3
kind: Sidecar
metadata:
  name: has-selector
  namespace: ns1
spec:
  workloadSelector: # Since this has a workload selector, it shouldn't conflict with the other Sidecar in the namespace
    labels:
      app: foo
  egress:
  - hosts:
    - "./*"
---