- match:
        - gateways:
            - test-egress
          port: 80
      route:
        - destination:
            host: "{{ .To.ClusterLocalFQDN }}"
            port:
              number: {{ (.To.PortForName "http").ServicePort }}
          weight: 100
      headers:
        request:
          add:
            x-egress-test: "handled-by-egress-gateway"
---
apiVersion: networking.istio.io/v1beta1

apiVersion: networking.istio.io/v1beta1
kind: ServiceEntry
metadata:
  name: egress
spec:
  hosts:
  - "google.com"
  - "*.egress.com"
  ports:
  - number: 80
    name: http
    protocol: HTTP
  - number: 443
    name: tls
    protocol: TLS
---
apiVersion: gateway.networking.k8s.io/v1beta1
kind: HTTPRoute
metadata:
  name: egress
  namespace: default
spec:
  parentRefs:
  - kind: ServiceEntry

					PodSelector: metav1.LabelSelector{
						MatchLabels: map[string]string{"a": "b"},
					},
					Ingress:     []networkingv1.NetworkPolicyIngressRule{},
					PolicyTypes: []networkingv1.PolicyType{networkingv1.PolicyTypeIngress},
				},
			},
		},
		{ // Defined Ingress and Egress should be set to Ingress,Egress
			original: &networkingv1.NetworkPolicy{
				Spec: networkingv1.NetworkPolicySpec{

kind: VirtualService
metadata:
  annotations:
    internal.istio.io/parents: HTTPRoute/egress.default
    internal.istio.io/route-semantics: gateway
  creationTimestamp: null
  name: egress-1-istio-autogenerated-k8s-gateway
  namespace: default
spec:
  gateways:
  - mesh
  hosts:
  - '*.egress.com'
  http:
  - name: default.egress.0
    route:
    - destination:
        host: google.com
        port:

		},
	}

	ingress.Ports = ports
	egress.Ports = ports

	if hasEndPort {
		ingress.Ports[0].EndPort = &endPort
		egress.Ports[0].EndPort = &endPort
	}

	if isIngress {
		netPol.Spec.Ingress = append(netPol.Spec.Ingress, ingress)
	}

	if isEgress {
		netPol.Spec.Egress = append(netPol.Spec.Egress, egress)
	}

	return netPol
}

					PodSelector: metav1.LabelSelector{
						MatchLabels: map[string]string{"a": "b"},
					},
					Ingress:     []extensionsv1beta1.NetworkPolicyIngressRule{},
					PolicyTypes: []extensionsv1beta1.PolicyType{extensionsv1beta1.PolicyTypeIngress},
				},
			},
		},
		{ // Defined Ingress and Egress should be set to Ingress,Egress
			original: &extensionsv1beta1.NetworkPolicy{
				Spec: extensionsv1beta1.NetworkPolicySpec{

4) `gateways` charts install a load balancer with `ingress` and `egress`.

Ingress secrets and access should be separated from the control plane.

```console
helm install -n istio-system istio-ingress manifests/charts/gateways/istio-ingress --set profile=openshift
```

Egress secrets and access should be separated from the control plane.

```console

)

// TestEgressGatewayTls brings up an cluster and will ensure that the TLS origination at
// egress gateway allows secure communication between the egress gateway and external workload.
// This test brings up an egress gateway to originate TLS connection. The test will ensure that requests
// are routed securely through the egress gateway and that the TLS origination happens at the gateway.
func TestEgressGatewayTls(t *testing.T) {

  namespace: ns1
spec:
  egress:
  - hosts:
    - "./*"
---
apiVersion: networking.istio.io/v1alpha3
kind: Sidecar
metadata:
  name: has-selector
  namespace: ns1
spec:
  workloadSelector: # Since this has a workload selector, it shouldn't conflict with the other Sidecar in the namespace
    labels:
      app: foo
  egress:
  - hosts:
    - "./*"
---

    controllerName: istio.io/gateway-controller
    parentRef:
      group: networking.istio.io
      kind: ServiceEntry
      name: egress
---
apiVersion: gateway.networking.k8s.io/v1alpha2
kind: TCPRoute
metadata:
  creationTimestamp: null
  name: egress
  namespace: default
spec: null
status:
  parents:
  - conditions:
    - lastTransitionTime: fake
      message: Route was valid