cases := []struct {
		name            string
		gateways        []config.Config
		virtualServices []config.Config
	}{
		{
			name: "no sni overlap",
			gateways: []config.Config{
				{
					Meta: config.Meta{Name: "gw", Namespace: "testns", GroupVersionKind: gvk.Gateway},
					Spec: &networking.Gateway{
						Servers: []*networking.Server{
							{

				},
			},
		},
		{
			name: "targetRef is not a match",
			selectionOpts: WorkloadPolicyMatcher{
				Namespace: "bar",
				WorkloadLabels: labels.Instance{
					constants.GatewayNameLabel: "my-gateway2",
				},
			},
			configs: []config.Config{
				newConfig("authz-1", "bar", policyWithTargetRef),
			},
			wantAllow: nil,
		},
		{
			name: "selector not match",

spec:
  hosts:
  - "*"
  gateways:
  - istio-system/gateway
  tcp:
  - route:
    - destination:
        host: productpage
        port:
          number: 9080
`
	runGatewayTest(t,
		simulationTest{
			name: "duplicate cross namespace gateway collision",
			config: createGateway("gateway", "istio-system", tcpServer) +

		}
	}
}

func vsHostInGateway(c analysis.Context, gateway resource.FullName, vsHosts []string, vsNamespace string) bool {
	var gatewayHosts []string
	var gatewayNs string

	c.ForEach(gvk.Gateway, func(r *resource.Instance) bool {
		if r.Metadata.FullName == gateway {
			s := r.Message.(*v1alpha3.Gateway)
			gatewayNs = r.Metadata.FullName.Namespace.String()
			for _, v := range s.Servers {

	autoPassthrough := false

	log.Debugf("MergeGateways: merging %d gateways", len(gateways))
	for _, gwAndInstance := range gateways {
		gatewayConfig := gwAndInstance.gateway
		gatewayName := gatewayConfig.Namespace + "/" + gatewayConfig.Name // Format: %s/%s
		gatewayCfg := gatewayConfig.Spec.(*networking.Gateway)
		log.Debugf("MergeGateways: merging gateway %q :\n%v", gatewayName, gatewayCfg)
		snames := sets.String{}

	virtualServices := lb.push.VirtualServicesForGateway(lb.node.ConfigNamespace, gateway)
	if len(virtualServices) == 0 {
		log.Warnf("no virtual service bound to gateway: %v", gateway)
	}
	for _, v := range virtualServices {
		vsvc := v.Spec.(*networking.VirtualService)
		// We have two cases here:
		// 1. virtualService hosts are 1.foo.com, 2.foo.com, 3.foo.com and gateway's hosts are ns/*.foo.com

	return analysis.Metadata{
		Name:        "gateway.IngressGatewayPortAnalyzer",
		Description: "Checks a gateway's ports against the gateway's Kubernetes service ports",
		Inputs: []config.GroupVersionKind{
			gvk.Gateway,
			gvk.Pod,
			gvk.Service,
		},
	}
}

// Analyze implements analysis.Analyzer
func (s *IngressGatewayPortAnalyzer) Analyze(c analysis.Context) {
	c.ForEach(gvk.Gateway, func(r *resource.Instance) bool {

{{- range $i := until .Services }}
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: vs-{{$i}}
  namespace: gateway
spec:
  hosts:
  - random-a-{{$i}}.host.example
  - random-b-{{$i}}.host.example
  - random-c-{{$i}}.host.example
  gateways:
  - gateway/gateway-{{$i}}
  http:
  - match:
    - uri:
        prefix: "/route-{{$i}}"
    route:
    - destination:

---
{{- range $i := until .Services }}
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: hello-ingress-{{$i}}
  namespace: default
spec:
  gateways:
  - knative-serving/knative-ingress-gateway
  - knative-serving/knative-local-gateway
  hosts:
  - hello.default
  - hello.default.external.domain
  - hello.default.svc
  - hello.default.svc.cluster.local
  http:
  - headers:
      request:

    Note that this only applies to the Kubernetes Gateway API, not the Istio `Gateway`.
    You can check if you are using this feature with the following command:

    {{< text bash >}}
    $ kubectl get gateways.gateway.networking.k8s.io -ojson | jq -r '.items[] | select(.spec.gatewayClassName == "istio") | select((.spec.addresses | length) == 0) | "Found managed gateway: " + .metadata.namespace + "/" + .metadata.name'