metadata:
  name: {{ .To.ServiceName }}
spec:
  selector:
    matchLabels:
      app: "{{ .To.ServiceName }}"
  mtls:
    mode: STRICT
---
apiVersion: networking.istio.io/v1beta1
kind: DestinationRule
metadata:
  name: {{ .To.ServiceName }}
spec:
  host: "{{ .To.ClusterLocalFQDN }}"
  trafficPolicy:
    tls:

apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
  name: originate-mtls-for-egress-gateway
spec:
  host: {{ .EgressGatewayServiceName | default "istio-egressgateway" }}.{{ .EgressGatewayServiceNamespace | default "istio-system" }}.svc.cluster.local
  trafficPolicy:
    tls:
      mode: ISTIO_MUTUAL

kind: PeerAuthentication
metadata:
  name: "default"
  annotations:
    test-suite: "beta-mtls-on"
spec:
  mtls:
    mode: STRICT
---
apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
  name: "default"
  annotations:
    test-suite: "beta-mtls-on"
spec:
  host: "*.local"
  trafficPolicy:
    tls:

kind: PeerAuthentication
metadata:
  name: "default"
  annotations:
    test-suite: "beta-mtls-permissive"
spec:
  mtls:
    mode: PERMISSIVE
---
apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
  name: "default"
  annotations:
    test-suite: "beta-mtls-permissive"
spec:
  host: "*.local"
  trafficPolicy:
    tls:

# No DR is added for this test. enableAutoMtls is expected on by default.
apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
  name: "default"
  annotations:
    test-suite: "beta-mtls-automtls"
spec:
  mtls:

kind: Gateway
metadata:
  name: istio-egressgateway
spec:
  selector:
    istio: egressgateway
  servers:
  - port:
      number: 443
      name: mtls-tcp
      protocol: TLS
    hosts:
    - fake.external.com
    tls:

kind: PeerAuthentication
metadata:
  name: "default"
  annotations:
    test-suite: "beta-mtls-off"
spec:
  mtls:
    mode: DISABLE
---
apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
  name: "default"
  annotations:
    test-suite: "beta-mtls-off"
spec:
  host: "*.local"
  trafficPolicy:
    tls:

  annotations:
    test-suite: "beta-mtls-automtls-workload"
spec:
  selector:
    matchLabels:
      app: a
  mtls:
    mode: DISABLE
---
apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
  name: "b-strict"
  annotations:
    test-suite: "beta-mtls-automtls-workload"
spec:
  selector:
    matchLabels:
      app: b
  mtls:
    mode: STRICT
  portLevelMtls:

  annotations:
    test-suite: "beta-per-port-mtls"
spec:
  selector:
    matchLabels:
      app: b
  mtls:
    mode: DISABLE
  portLevelMtls:
    # 8090 is the targetPort for service http(80)
    8090:
      mode: STRICT
---
apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
  name: "default"
  annotations:
    test-suite: "beta-per-port-mtls"
spec:
  host: "*.local"
  trafficPolicy:

apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: direct-cnn-through-egress-gateway
spec:
  hosts:
  - fake.external.com
  gateways:
  - istio-egressgateway
  - mesh
  tls:
  - match:
    - gateways:
      - mesh
      port: 443
      sniHosts:
      - fake.external.com
    route:
    - destination:
        host: istio-egressgateway.istio-system.svc.cluster.local
        port: