- endpoint:
                  address:
                    socket_address:
                      address: ratelimit.default.svc.cluster.local
                      port_value: 8081
---
apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
  name: filter-ratelimit-svc
  namespace: istio-system
spec:
  workloadSelector:
    labels:
      istio: ingressgateway
  configPatches:

  rules:
    - filters:
        - type: RequestHeaderModifier
          requestHeaderModifier:
            add:
              - name: my-header
                value: foo
      backendRefs:
        - name: my-filter-svc1
          weight: 1

    value:
      stringMatch:
        prefix: istio-ext-authz
  grpcService:
    envoyGrpc:
      authority: my-custom-ext-authz.foo.svc.cluster.local
      clusterName: outbound|9000||my-custom-ext-authz.foo.svc.cluster.local
    timeout: 0.002s
  statusOnError:
    code: Forbidden
  transportApiVersion: V3
  withRequestBody:
    allowPartialMessage: true

            - mesh
          port: 80
      route:
        - destination:
            host: "{{ .EgressGatewayServiceName | default "istio-egressgateway" }}.{{ .EgressGatewayServiceNamespace | default .SystemNamespace.Name }}.svc.cluster.local"
            port:
              number: 80
          weight: 100
    - match:
        - gateways:
            - test-egress
          port: 80
      route:
        - destination:

		doLabel := func(labels map[string]string) error {
			// update needs the latest version
			svc, err := c.Kube().CoreV1().Services(ns.Name()).Get(t.Context(), service, metav1.GetOptions{})
			if err != nil {
				return err
			}
			svc.ObjectMeta.SetLabels(labels)
			_, err = c.Kube().CoreV1().Services(ns.Name()).Update(t.Context(), svc, metav1.UpdateOptions{})
			return err
		}

		if err = doLabel(newLabels); err != nil {

  http:
  - route:
    - destination:
        host: reviews
---
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: reviews
  namespace: bar
spec:
  hosts:
  - reviews.foo.svc.cluster.local # shouldn't generate an error as the gateway is different even though host is the same
  gateways:
  - istio-ingressgateway
  http:
  - route:
    - destination:
        host: reviews
---

TEXT	·Syscall(SB),NOSPLIT,$0-56
	BL	runtime·entersyscall<ABIInternal>(SB)
	MOVD	trap+0(FP), R16
	MOVD	a1+8(FP), R0
	MOVD	a2+16(FP), R1
	MOVD	a3+24(FP), R2
	SVC	$0x80
	BCC	ok
	MOVD	$-1, R1
	MOVD	R1, r1+32(FP)	// r1
	MOVD	ZR, r2+40(FP)	// r2
	MOVD	R0, err+48(FP)	// err
	BL	runtime·exitsyscall<ABIInternal>(SB)
	RET
ok:
	MOVD	R0, r1+32(FP) // r1

    value:
      stringMatch:
        prefix: istio-ext-authz
  grpcService:
    envoyGrpc:
      authority: my-custom-ext-authz.foo.svc.cluster.local
      clusterName: outbound|9000||my-custom-ext-authz.foo.svc.cluster.local
    timeout: 0.002s
  statusOnError:
    code: Forbidden
  transportApiVersion: V3
  withRequestBody:
    allowPartialMessage: true

    - port: 15012
      sniHosts:
      - "*"
    route:
    - destination:
        host: istiod.istio-system.svc.cluster.local
        port:
          number: 15012
  - match:
    - port: 15017
      sniHosts:
      - "*"
    route:
    - destination:
        host: istiod.istio-system.svc.cluster.local
        port:

# Attempt to use all possible fields in DestinationRule
apiVersion: networking.istio.io/v1alpha3
kind: ServiceEntry
metadata:
  name: destall
  namespace: testns
spec:
   hosts:
   - destall.default.svc.cluster.local
   ports:
   - number: 81
     name: http
     protocol: HTTP
   resolution: STATIC
   endpoints:
    - address: 127.0.0.2
      ports:
        http: 7072
---
apiVersion: networking.istio.io/v1alpha3