tests := map[string]struct {
		external v1beta1.IngressSpec
		internal networking.IngressSpec
	}{
		"service-port-number": {
			external: v1beta1.IngressSpec{
				Backend: &v1beta1.IngressBackend{
					ServiceName: "test-backend",
					ServicePort: intstr.FromInt32(8080),
				},
			},
			internal: networking.IngressSpec{
				DefaultBackend: &networking.IngressBackend{
					Service: &networking.IngressServiceBackend{

    - operation:
        hosts:
{{- range $svc := .Services }}
        - "example.{{ $svc.ServiceName }}.com"
{{- end }}
    from:
    - source:
        requestPrincipals: ["******@****.***/sub-1"]
  - to:
    - operation:
        hosts:
  {{- range $svc := .Services }}
        - "any-request-principal-ok.{{ $svc.ServiceName }}.com"
  {{- end }}
    from:
    - source:
        requestPrincipals: ["*"]
  - to:

kind: VirtualService
metadata:
  name: route-via-egressgateway-2
  namespace: {{ .From.NamespaceName }}
spec:
  hosts:
    - "{{ .Allowed.ServiceName }}-{{ .Allowed.NamespaceName }}-only.com"
    - "jwt-only.com"
    - "jwt-and-{{ .Allowed.ServiceName }}-{{ .Allowed.NamespaceName }}-only.com"
  gateways:
    - test-egress
    - mesh
  http:
    - match:
        - gateways:
            - mesh

apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: policy-{{ .To.ServiceName }}-bad
spec:
  selector:
    matchLabels:
      "app": "{{ .To.ServiceName }}"
      "foo": "bla"
  rules:
    - to:
        - operation:

apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
  name: {{ .To.ServiceName }}
spec:
  selector:
    matchLabels:
      app: {{ .To.ServiceName }}
  mtls:

# mTLS is required in order to match source principals.

apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: {{ .To.ServiceName }}
  namespace: {{ .To.NamespaceName }}
spec:
  selector:
    matchLabels:
      "app": "{{ .To.ServiceName }}"
  action: DENY
  rules:
    - from:
        - source:
            notPrincipals: [ "*" ]

---

        "fieldsV1": {},
        "subresource": "subresourceValue"
      }
    ]
  },
  "spec": {
    "ingressClassName": "ingressClassNameValue",
    "backend": {
      "serviceName": "serviceNameValue",
      "servicePort": "servicePortValue",
      "resource": {
        "apiGroup": "apiGroupValue",
        "kind": "kindValue",
        "name": "nameValue"
      }
    },
    "tls": [

        "fieldsV1": {},
        "subresource": "subresourceValue"
      }
    ]
  },
  "spec": {
    "ingressClassName": "ingressClassNameValue",
    "backend": {
      "serviceName": "serviceNameValue",
      "servicePort": "servicePortValue",
      "resource": {
        "apiGroup": "apiGroupValue",
        "kind": "kindValue",
        "name": "nameValue"
      }
    },
    "tls": [

      kind: kindValue
      name: nameValue
    serviceName: serviceNameValue
    servicePort: servicePortValue
  ingressClassName: ingressClassNameValue
  rules:
  - host: hostValue
    http:
      paths:
      - backend:
          resource:
            apiGroup: apiGroupValue
            kind: kindValue
            name: nameValue
          serviceName: serviceNameValue
          servicePort: servicePortValue

apiVersion: security.istio.io/v1beta1
kind: RequestAuthentication
metadata:
  name: {{ .To.ServiceName }}
spec:
  selector:
    matchLabels:
      app: {{ .To.ServiceName }}
  jwtRules:
  - issuer: "******@****.***"
    jwksUri: "{{ .JWTServer.JwksURI }}"
    outputPayloadToHeader: "x-test-payload"