kind: Gateway
metadata:
  name: {{ .To.ServiceName }}-gateway
spec:
  gatewayClassName: istio
  listeners:
  - name: http
    port: 80
    protocol: HTTP
    hostname: "*.{{ .To.ServiceName }}.com"
---
apiVersion: gateway.networking.k8s.io/v1beta1
kind: HTTPRoute
metadata:
  name: {{ .To.ServiceName }}
spec:
  parentRefs:
  - name: {{ .To.ServiceName }}-gateway
  hostnames:

     * 
     * @param serviceName
     *            JAAS configuration name
     */
    public JAASAuthenticator ( String serviceName ) {
        super(null);
        this.serviceName = serviceName;
    }


    /**
     * Create an authenticator using the given JAAS service and the specified credentials
     * 
     * @param serviceName
     *            JAAS configuration name

# The following policy denies access to "internal.{{ .To.ServiceName }}.company.com"
# and path "/private", denies access from 172.17.72.46 or 192.168.4.0/23 to
# "remoteipblocks.{{ .To.ServiceName }}.company.com", denies access from anything
# but 172.23.240.0/22 to "notremoteipblocks.{{ .To.ServiceName }}.company.com",
# and denies access to "remoteipattr.{{ .To.ServiceName }}.company.com" when the
# remote ip is 10.242.5.7 or in the network 10.124.99.0/24.

	}
	n.Tproxy = match.ServiceName(echo.NamespacedName{Name: TproxySvc, Namespace: ns}).GetMatches(echos)
	n.Headless = match.ServiceName(echo.NamespacedName{Name: HeadlessSvc, Namespace: ns}).GetMatches(echos)
	n.StatefulSet = match.ServiceName(echo.NamespacedName{Name: StatefulSetSvc, Namespace: ns}).GetMatches(echos)

apiVersion: security.istio.io/v1beta1
kind: RequestAuthentication
metadata:
  name: {{ .To.ServiceName }}-part1
spec:
  selector:
    matchLabels:
      app: {{ .To.ServiceName }}
  jwtRules:
  - issuer: "******@****.***"
    jwksUri: "https://raw.githubusercontent.com/istio/istio/master/tests/common/jwt/jwks.json"
    audiences:
    - "foo"
  - issuer: "******@****.***"

func (e *EndpointIndex) deleteServiceInner(shard ShardKey, serviceName, namespace string, preserveKeys bool) {
	if e.shardsBySvc[serviceName] == nil ||
		e.shardsBySvc[serviceName][namespace] == nil {
		return
	}
	epShards := e.shardsBySvc[serviceName][namespace]
	epShards.Lock()
	delete(epShards.Shards, shard)
	// Clear the cache here to avoid race in cache writes.
	e.clearCacheForService(serviceName, namespace)
	if !preserveKeys {

kind: Gateway
metadata:
  name: {{ .To.ServiceName }}-gateway
spec:
  gatewayClassName: istio
  listeners:
  - name: http
    port: 80
    protocol: HTTP
    hostname: "*.{{ .To.ServiceName }}.com"
---
apiVersion: gateway.networking.k8s.io/v1beta1
kind: HTTPRoute
metadata:
  name: {{ .To.ServiceName }}
spec:
  parentRefs:
  - name: {{ .To.ServiceName }}-gateway
  hostnames:

apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: authz-gateway-{{ .To.ServiceName }}
spec:
  targetRef:
    name: {{ .To.ServiceName }}-gateway
    kind: Gateway
    group: gateway.networking.k8s.io
  rules:
  - to:
    - operation:
        hosts:
{{- range $svc := .Services }}
        - "example.{{ $svc.ServiceName }}.com"
{{- end }}
    from:
    - source:

kind: Gateway
metadata:
  name: {{ .To.ServiceName }}-gateway
spec:
  gatewayClassName: istio
  listeners:
  - name: http
    # Exposing port 80 isn't the recommended security practice 
    port: 80
    protocol: HTTP
    hostname: "*.{{ .To.ServiceName }}.com"
---
apiVersion: gateway.networking.k8s.io/v1beta1
kind: HTTPRoute
metadata:
  name: {{ .To.ServiceName }}
spec:
  parentRefs:

apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: policy-system-{{ .To.ServiceName }}
spec:
  selector:
    matchLabels:
      "app": "{{ .To.ServiceName }}"
  rules:
  - to:
    - operation:
        paths: ["/policy-system-{{ .To.ServiceName }}"]