metadata:
  name: ns-default
  namespace: {{ .To.NamespaceName }}
spec:
  mtls:
    mode: PERMISSIVE

---
# This configures requests to any service in the namespace to use mTLS.

apiVersion: networking.istio.io/v1beta1
kind: DestinationRule
metadata:
  name: default
  namespace: {{ .To.NamespaceName }}
spec:
  host: "*.{{ .To.NamespaceName }}.svc.cluster.local"
  trafficPolicy:
    tls:

			existingConfigMap: createConfigMap(namespaceName, configMapName, map[string]string{}),
			expectedActions: []ktesting.Action{
				ktesting.NewUpdateAction(gvr, namespaceName, createConfigMap(namespaceName, configMapName, testData)),
			},
			expectedErr: "",
		},
		{
			name:              "existing nop ConfigMap",
			existingConfigMap: createConfigMap(namespaceName, configMapName, testData),

apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: route-via-egressgateway-2
  namespace: {{ .From.NamespaceName }}
spec:
  hosts:
    - "{{ .Allowed.ServiceName }}-{{ .Allowed.NamespaceName }}-only.com"
    - "jwt-only.com"
    - "jwt-and-{{ .Allowed.ServiceName }}-{{ .Allowed.NamespaceName }}-only.com"
  gateways:
    - test-egress
    - mesh
  http:
    - match:
        - gateways:

      from:
        - source:
            namespaces: [ "{{ .Allowed.NamespaceName }}" ]
    - to:
        - operation: # GRPC
            ports: [ "{{ (.To.PortForName `grpc`).WorkloadPort }}" ]
            paths: [ "/proto.EchoTestService/Echo" ]
            methods: [ "POST" ]
      from:
        - source:
            namespaces: [ "{{ .Allowed.NamespaceName }}" ]
    - to:
        - operation: # TCP

      from:
        - source:
            namespaces: [ "{{ .Denied.NamespaceName }}" ]
    - to:
        - operation: # GRPC
            ports: [ "{{ (.To.PortForName `grpc`).WorkloadPort }}" ]
            paths: [ "/proto.EchoTestService/Echo" ]
            methods: [ "POST" ]
      from:
        - source:
            namespaces: [ "{{ .Denied.NamespaceName }}" ]
    - to:
        - operation: # TCP

		accessor, err := meta.Accessor(attr.GetObject())
		if err != nil {
			return nil, err
		}
		return accessor.GetLabels(), nil
	}

	namespaceName := attr.GetNamespace()
	namespace, err := m.NamespaceLister.Get(namespaceName)
	if err != nil && !apierrors.IsNotFound(err) {
		return nil, err
	}
	if apierrors.IsNotFound(err) {

	Name string
}

// NamespaceName returns the string name of the namespace, or "" if Namespace is nil.
func (n NamespacedName) NamespaceName() string {
	if n.Namespace != nil {
		return n.Namespace.Name()
	}
	return ""
}

// String returns the Istio-formatted service name in the form of <namespace>/<name>.
func (n NamespacedName) String() string {
	return n.NamespaceName() + "/" + n.Name
}

---

# The following gateway allows request to "*.{{ .To.ServiceName }}.com"

apiVersion: networking.istio.io/v1beta1
kind: Gateway
metadata:
  name: gw-{{ .To.ServiceName }}
  namespace: {{ .To.NamespaceName }}
spec:
  selector:
    istio: ingressgateway # use istio default ingress gateway
  servers:
    - port:
        number: 80
        name: http
        protocol: HTTP
      hosts:

			var namespace *v1.Namespace
			namespaceName := a.GetNamespace()

			// Special case, the namespace object has the namespace of itself (maybe a bug).
			// unset it if the incoming object is a namespace
			if gvk := a.GetKind(); gvk.Kind == "Namespace" && gvk.Version == "v1" && gvk.Group == "" {
				namespaceName = ""
			}

			// if it is cluster scoped, namespaceName will be empty

metadata:
  name: {{ .To.ServiceName }}-deny
spec:
  selector:
    matchLabels:
      "app": "{{ .To.ServiceName }}"
  action: DENY
  rules:
    - from:
      - source: