- match:
        - gateways:
            - test-egress
          port: 80
      route:
        - destination:
            host: "{{ .To.ClusterLocalFQDN }}"
            port:
              number: {{ (.To.PortForName "http").ServicePort }}
          weight: 100
      headers:
        request:
          add:
            x-egress-test: "handled-by-egress-gateway"
---
apiVersion: networking.istio.io/v1beta1

apiVersion: release-notes/v2
kind: feature
area: traffic-management
releaseNotes:
   - |
     **Added** the ability to set credentialName based secret configuration
     at sidecars for egress TLS traffic when WorkloadSelector is specified in `DestinationRule`,
     provided the sidecar has permission to list secrets in the namespace where it resides.
docs:

Vadim Eisenberg <******@****.***> 1558544845 +0300

apiVersion: networking.istio.io/v1beta1
kind: ServiceEntry
metadata:
  name: egress
spec:
  hosts:
  - "google.com"
  - "*.egress.com"
  ports:
  - number: 80
    name: http
    protocol: HTTP
  - number: 443
    name: tls
    protocol: TLS
---
apiVersion: gateway.networking.k8s.io/v1beta1
kind: HTTPRoute
metadata:
  name: egress
  namespace: default
spec:
  parentRefs:
  - kind: ServiceEntry

					PodSelector: metav1.LabelSelector{
						MatchLabels: map[string]string{"a": "b"},
					},
					Ingress:     []networkingv1.NetworkPolicyIngressRule{},
					PolicyTypes: []networkingv1.PolicyType{networkingv1.PolicyTypeIngress},
				},
			},
		},
		{ // Defined Ingress and Egress should be set to Ingress,Egress
			original: &networkingv1.NetworkPolicy{
				Spec: networkingv1.NetworkPolicySpec{

  egress:
  - hosts:
    - "./*"
---
apiVersion: networking.istio.io/v1alpha3
kind: Sidecar
metadata:
  name: maps-to-nonexistent
  namespace: default
spec:
  workloadSelector:
    labels:
      app: bogus # This doesn't exist, and should generate an error
  egress:
  - hosts:
    - "./*"
---
apiVersion: networking.istio.io/v1alpha3

kind: VirtualService
metadata:
  annotations:
    internal.istio.io/parents: HTTPRoute/egress.default
    internal.istio.io/route-semantics: gateway
  creationTimestamp: null
  name: egress-1-istio-autogenerated-k8s-gateway
  namespace: default
spec:
  gateways:
  - mesh
  hosts:
  - '*.egress.com'
  http:
  - name: default.egress.0
    route:
    - destination:
        host: google.com
        port:

		},
	}

	ingress.Ports = ports
	egress.Ports = ports

	if hasEndPort {
		ingress.Ports[0].EndPort = &endPort
		egress.Ports[0].EndPort = &endPort
	}

	if isIngress {
		netPol.Spec.Ingress = append(netPol.Spec.Ingress, ingress)
	}

	if isEgress {
		netPol.Spec.Egress = append(netPol.Spec.Egress, egress)
	}

	return netPol
}

	if o == nil {
		return
	}

	fs.StringVar(&o.ConfigFile, "egress-selector-config-file", o.ConfigFile,
		"File with apiserver egress selector configuration.")
}

// ApplyTo adds the egress selector settings to the server configuration.
// In case egress selector settings were not provided by a cluster-admin
// they will be prepared from the recommended/default/no-op values.

					PodSelector: metav1.LabelSelector{
						MatchLabels: map[string]string{"a": "b"},
					},
					Ingress:     []extensionsv1beta1.NetworkPolicyIngressRule{},
					PolicyTypes: []extensionsv1beta1.PolicyType{extensionsv1beta1.PolicyTypeIngress},
				},
			},
		},
		{ // Defined Ingress and Egress should be set to Ingress,Egress
			original: &extensionsv1beta1.NetworkPolicy{
				Spec: extensionsv1beta1.NetworkPolicySpec{