apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
  name: db-tls
spec:
  host: mydbserver.prod.svc.cluster.local
  trafficPolicy:
    tls:
      mode: SIMPLE

metadata:
  name: db-tls
spec:
  host: mydbserver.prod.svc.cluster.local
  trafficPolicy:
    portLevelSettings:
      - port:
          number: 443
        tls:
          mode: SIMPLE

apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
  name: db-tls
spec:
  host: mydbserver.prod.svc.cluster.local
  trafficPolicy:
    tls:
      mode: SIMPLE
      credentialName: db-credential
  workloadSelector:
      matchLabels:

metadata:
  name: db-tls
spec:
  host: mydbserver.prod.svc.cluster.local
  trafficPolicy:
    portLevelSettings:
      - port:
          number: 443
        tls:
          mode: SIMPLE
          credentialName: db-credential
  workloadSelector:
      matchLabels:

	}
}

func haveSameCertificate(currentGatewayTLS, gatewayTLS *v1alpha3.ServerTLSSettings) bool {
	if currentGatewayTLS.CredentialName != "" && gatewayTLS.CredentialName != "" {
		return currentGatewayTLS.CredentialName == gatewayTLS.CredentialName
	}

	if currentGatewayTLS.CredentialName == "" && gatewayTLS.CredentialName == "" {
		if currentGatewayTLS.ServerCertificate != "" && gatewayTLS.ServerCertificate != "" {

  namespace: istio-system
spec:
  selector:
    istio: ingressgateway
  servers:
  - port:
      number: 443
      name: https
      protocol: HTTPS
    tls:
      mode: SIMPLE
      credentialName: "test-01-wildcard-cert" # validation error since have same certificate with gateway-02-test-01
    hosts:
    - "01.test-01.com"
---
apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:

				},
				err: nil,
			},
		},
		{
			name: "tls mode SIMPLE, with CredentialName specified",
			opts: &buildClusterOpts{
				mutable: newTestCluster(),
			},
			tls: &networking.ClientTLSSettings{
				Mode:            networking.ClientTLSSettings_SIMPLE,
				CredentialName:  credentialName,
				SubjectAltNames: []string{"SAN"},
				Sni:             "some-sni.com",
			},

  - port:
      number: 443
      name: https
      protocol: HTTPS
    tls:
      mode: SIMPLE
      credentialName: "httpbin-credential"
    hosts:
    - "httpbin.example.com"
---
apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: defaultgateway-nocredential # No credentialName specified, we shouldn't generate any errors
spec:
  selector:
    istio: ingressgateway
  servers:
  - port:

				CredentialName:    "some credential",
				ClientCertificate: "",
				PrivateKey:        "",
				CaCertificates:    "",
			},
			valid: true,
		},
		{
			name: "SIMPLE CredentialName set with ClientCertificate specified",
			tls: &networking.ClientTLSSettings{
				Mode:              networking.ClientTLSSettings_SIMPLE,
				CredentialName:    "credential",

        # use a valid credential here
        credentialName: "$CREDENTIAL_NAME"
      hosts:
      # use a valid gateway host and domain for istiod
      - "ISTIOD-HOST.DOMAIN"
    - port:
        name: https-istiodwebhook
        number: 15017
        protocol: https
      tls:
        mode: SIMPLE
        # use a valid credential here
        credentialName: "$CREDENTIAL_NAME"
      hosts: