rules:
    - to: # only allow /allow for company.com
        - operation:
            paths: [ "/allow" ]
            hosts: [ "www.company.com" ]
    - to: # checks only a call 443 over istio mutual without JWT
        - operation:
            hosts: [ "{{ .Allowed.ServiceName }}-{{ .Allowed.NamespaceName }}-only.com" ]
      from:
        - source:

spec:
  selector:
    istio: ingressgateway
  servers:
  - hosts:
    - testing-01.com
    port:
      name: http
      number: 80
      protocol: HTTP
---
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: testing-service-01-test-01
  namespace: default
spec:
  gateways:
  - istio-system/testing-gateway-01-test-01
  hosts:
  - testing-01.com
  http:
  - route:

metadata:
  name: byon
  namespace: testns
spec:
   hosts:
   - byon.test.istio.io
   ports:
   - number: 80
     name: http
     protocol: HTTP
   resolution: STATIC
   endpoints:
    - address: 127.0.0.2
      ports:
        http: 7072
---
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: byon
  namespace: testns
spec:
  hosts:
    - mybyon.test.istio.io
  http:

  servers:
  - port:
      number: 443
      name: https
      protocol: HTTPS
    tls:
      mode: SIMPLE
      credentialName: "httpbin-credential" # Correct credential, should not produce an error message
    hosts:
    - "httpbin.example.com"
---
apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: defaultgateway-bogusCredentialName
spec:
  selector:

apiVersion: networking.istio.io/v1alpha3
kind: ServiceEntry
metadata:
  name: external-reviews
  namespace: default
spec:
  hosts:
  - external-reviews.org
---
apiVersion: networking.istio.io/v1alpha3
kind: ServiceEntry
metadata:
  name: eu-wildcard
  namespace: default
spec:
  hosts:
  - "*.eu.bookinfo.com"
---
apiVersion: networking.istio.io/v1alpha3
kind: ServiceEntry
metadata:

    internal.istio.io/parents: Gateway/gateway/default.istio-system
  creationTimestamp: null
  name: gateway-istio-autogenerated-k8s-gateway-default
  namespace: istio-system
spec:
  servers:
  - hosts:
    - '*/*.domain.example'
    port:
      name: default
      number: 80
      protocol: HTTP
---
apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  annotations:

apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  creationTimestamp: null
  name: foo-istio-autogenerated-k8s-ingress-ns
  namespace: istio-system
spec:
  selector:
    istio: ingressgateway
  servers:
  - hosts:
    - '*'
    port:
      name: http-80-ingress-foo-ns
      number: 80
      protocol: HTTP
---
apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  creationTimestamp: null

          # don't overwrite /etc/hosts since it's managed by kubeproxy
          #sudo sh -c 'cat /var/run/secrets/istio/bootstrap/hosts >> /etc/hosts'

          # since we're not overwriting /etc/hosts on k8s, verify that istiod hostname in /etc/hosts
          # matches the value generated by istioctl
          echo "checking istio host"
          SYSTEM_HOST=$(cat /etc/hosts | grep istiod)

				ServiceSettings: []*meshconfig.MeshConfig_ServiceSettings{
					{
						Settings: &meshconfig.MeshConfig_ServiceSettings_Settings{
							ClusterLocal: false,
						},
						Hosts: []string{"*.kube-system.svc.cluster.local"},
					},
				},
			},
			host:     "s.kube-system.svc.cluster.local",
			expected: false,
		},
		{
			name: "override default service",
			m: &meshconfig.MeshConfig{

}

// NewNames converts a slice of host name strings to type Names.
func NewNames(hosts []string) Names {
	result := make(Names, 0, len(hosts))
	for _, host := range hosts {
		result = append(result, Name(host))
	}
	return result
}

// NamesForNamespace returns the subset of hosts that are in the specified namespace.
// The list of hosts contains host names optionally qualified with namespace/ or */.