metadata:
  name: productpage
spec:
  host: productpage
  trafficPolicy:
    tls:
      mode: ISTIO_MUTUAL
  subsets:
  - name: v1
    labels:
      version: v1
---
apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
  name: reviews
spec:
  host: reviews
  trafficPolicy:
    tls:
      mode: ISTIO_MUTUAL
  subsets:
  - name: v1
    labels:
      version: v1
  - name: v2
    labels:

# securityNotes is a markdown listing of any changes related to the security of
# Istio.
securityNotes:
  - |
    __Source principal validation at Gateway does not work even with ISTIO_MUTUAL TLS mode__:

  subsets:
  - name: "vistio"
    labels:
      version: "vistio"
    trafficPolicy:
      tls:
        mode: ISTIO_MUTUAL
  - name: "vlegacy"
    labels:
      version: "vlegacy"
    trafficPolicy:
      tls:
        mode: ISTIO_MUTUAL
  trafficPolicy:
    tls:

spec:
  selector:
    istio: egressgateway
  servers:
  - port:
      number: 443
      name: mtls-tcp
      protocol: TLS
    hosts:
    - fake.external.com
    tls:

      protocol: TLS
    hosts:
    - external.{{ .externalNamespace }}.svc.cluster.local
    tls:
      mode: ISTIO_MUTUAL
  - port:
      number: 443
      name: https
      protocol: TLS
    hosts:
    - external.{{ .externalNamespace }}.svc.cluster.local
    tls:

apiVersion: release-notes/v2
kind: bug-fix
area: traffic-management
releaseNotes:
- |
  **Fixed** an issue where using `ISTIO_MUTUAL` TLS mode in Gateways while also setting `credentialName` cause mutual TLS to not be configured.
  This configuration is now rejected, as `ISTIO_MUTUAL` is intended to be used without `credentialName` set.

        number: 80
        name: http
        protocol: HTTP
      hosts:
        - "www.company.com"
    - port:
        number: 443
        name: https
        protocol: HTTPS
      tls:
        mode: ISTIO_MUTUAL
      hosts:
        - "*"
---

apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: route-via-egressgateway
  namespace: {{ .From.NamespaceName }}
spec:
  hosts:

apiVersion: release-notes/v2
kind: bug-fix
area: telemetry

releaseNotes:
  - |

  trafficPolicy:
    tls:
      mode: ISTIO_MUTUAL
      subjectAltNames:
      - "spiffe://cluster.local/ns/NS/sa/default"
`
	correctIdentityDR = `apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
  name: "service-b-dr"
spec:
  host: "b.NS.svc.cluster.local"
  trafficPolicy:
    tls:
      mode: ISTIO_MUTUAL
      subjectAltNames:
      - "spiffe://cluster.local/ns/NS/sa/b"

    mode: STRICT
---
apiVersion: networking.istio.io/v1beta1
kind: DestinationRule
metadata:
  name: {{ .To.ServiceName }}
spec:
  host: "{{ .To.ClusterLocalFQDN }}"
  trafficPolicy:
    tls: