apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
  name: db-tls
spec:
  host: mydbserver.prod.svc.cluster.local
  trafficPolicy:
    tls:
      mode: SIMPLE

apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
  name: valid-destination-rule
spec:
  host: c
  subsets:
    - name: v1
      labels:
        version: v1
    - name: v2
      labels:

apiVersion: networking.istio.io/v1beta1
kind: DestinationRule
metadata:
  name: valid-destination-rule
spec:
  host: c
  subsets:
    - name: v1
      labels:
        version: v1
    - name: v2
      labels:

apiVersion: networking.istio.io/v1
kind: DestinationRule
metadata:
  name: valid-destination-rule
spec:
  host: c
  subsets:
    - name: v1
      labels:
        version: v1
    - name: v2
      labels:

apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
  name: db-tls
spec:
  host: mydbserver.prod.svc.cluster.local
  trafficPolicy:
    portLevelSettings:
      - port:
          number: 443
        tls:
          mode: SIMPLE

apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
  name: db-tls
spec:
  host: mydbserver.prod.svc.cluster.local
  trafficPolicy:
    portLevelSettings:
      - port:
          number: 443
        tls:
          mode: SIMPLE
          credentialName: db-credential
  workloadSelector:
      matchLabels:

apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
  name: db-tls
spec:
  host: mydbserver.prod.svc.cluster.local
  trafficPolicy:
    tls:
      mode: SIMPLE
      credentialName: db-credential
  workloadSelector:
      matchLabels:

	return analysis.Metadata{
		Name:        "destinationrule.CaCertificateAnalyzer",
		Description: "Checks if caCertificates is set when TLS mode is SIMPLE/MUTUAL",
		Inputs: []config.GroupVersionKind{
			gvk.DestinationRule,
		},
	}
}

func (c *CaCertificateAnalyzer) Analyze(ctx analysis.Context) {
	ctx.ForEach(gvk.DestinationRule, func(r *resource.Instance) bool {
		c.analyzeDestinationRule(r, ctx)

	}

	return false
}

func initDestHostsAndSubsets(ctx analysis.Context) map[hostAndSubset]bool {
	hostsAndSubsets := make(map[hostAndSubset]bool)
	ctx.ForEach(gvk.DestinationRule, func(r *resource.Instance) bool {
		dr := r.Message.(*v1alpha3.DestinationRule)
		drNamespace := r.Metadata.FullName.Namespace

		for _, ss := range dr.GetSubsets() {
			hs := hostAndSubset{

func (ps *PushContext) mergeDestinationRule(p *consolidatedDestRules, destRuleConfig config.Config, exportToSet sets.Set[visibility.Instance]) {
	rule := destRuleConfig.Spec.(*networking.DestinationRule)
	resolvedHost := host.Name(rule.Host)

	var destRules map[host.Name][]*ConsolidatedDestRule

	if resolvedHost.IsWildCarded() {
		destRules = p.wildcardDestRules
	} else {
		destRules = p.specificDestRules