internal.istio.io/parents: Gateway/gateway/default.istio-system
  creationTimestamp: null
  name: gateway-istio-autogenerated-k8s-gateway-default
  namespace: istio-system
spec:
  servers:
  - hosts:
    - '*/*.domain.example'
    port:
      name: default
      number: 80
      protocol: HTTP
---
apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  annotations:

# Set up a Service associated with our proxy, which will run as 1.1.1.1 IP
apiVersion: networking.istio.io/v1alpha3
kind: ServiceEntry
metadata:
  name: proxy-service-instance
spec:
  hosts:
  - example.com
  ports:
  - number: 7070
    name: tcp
    protocol: TCP
  resolution: STATIC
  location: MESH_INTERNAL
  endpoints:
  - address: 1.1.1.1
    labels:
      security.istio.io/tlsMode: istio
---

# This ServiceEntry exposes the hosts needed for installing packages with apt-get.
# After applying this file, Istio-enabled pods (configured apt-get) be able to execute
# `apt-get upgrade` and `apt-get install`.  If this is not installed you may get
# "404  Not Found"

apiVersion: networking.istio.io/v1alpha3
kind: ServiceEntry
metadata:
  name: make-aptget-work
spec:
  hosts:
  - deb.debian.org
  - cdn-fastly.deb.debian.org

spec:
  selector:
    istio: ingressgateway
  servers:
  - port:
      number: 80
      name: http
      protocol: HTTP
    hosts:
    - "*"
---
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: tornado
spec:
  hosts:
  - "*"
  gateways:
  - tornado-gateway
  http:
  - match:
    - uri:
        prefix: /
    route:
    - destination:

  servers:
  - port:
      number: 80
      name: tcp-80
      protocol: TCP
    hosts:
    - external.{{ .externalNamespace }}.svc.cluster.local
  - port:
      number: 443
      name: tcp-443
      protocol: TCP
    hosts:

  servers:
  - port:
      number: 80
      name: http
      protocol: TLS
    hosts:
    - external.{{ .externalNamespace }}.svc.cluster.local
    tls:
      mode: ISTIO_MUTUAL
  - port:
      number: 443
      name: https
      protocol: TLS
    hosts:
    - external.{{ .externalNamespace }}.svc.cluster.local
    tls:

    internal.istio.io/route-semantics: ingress
  creationTimestamp: null
  name: foo-org-tls-istio-autogenerated-k8s-ingress
  namespace: bar
spec:
  gateways:
  - istio-system/tls-istio-autogenerated-k8s-ingress-bar
  hosts:
  - foo.org
  http:
  - route:
    - destination:
        host: httpbin.bar.svc.mydomain
        port:
          number: 80
      weight: 100
---
apiVersion: networking.istio.io/v1alpha3
kind: Gateway

  servers:
    - port:
        number: 443
        name: https
        protocol: HTTPS
      tls:
        mode: SIMPLE
        credentialName: "invalid-key" # wrong key names, should have one error
      hosts:
        - "httpbin.example.com"
---
apiVersion: v1
data:
  tls.cert: aHVzaCBodXNoIGh1c2gK
kind: Secret
metadata:
  name: missing-key
  namespace: istio-system
type: kubernetes.io/tls
---

# ensure go's non-cgo resolver respects /etc/hosts

# Stability, security, and performance are not guaranteed - use at your own risk.
meshConfig:
  defaultConfig:
    proxyMetadata:
      # Enable Istio agent to handle DNS requests for known hosts
      # Unknown hosts will automatically be resolved using upstream dns servers in resolv.conf