kind: DestinationRule
metadata:
  name: tunnel-outbound-traffic-to-external-svc-via-external-forward-proxy
spec:
  host: external-forward-proxy.{{ .externalNamespace }}.svc.cluster.local
  subsets:
  - name: external-svc-tcp
    trafficPolicy:
      tunnel:
        targetHost: external.{{ .externalNamespace }}
        targetPort: {{ .externalSvcTcpPort }}
  - name: external-svc-tls
    trafficPolicy:
      tunnel:

          "address": "/10.244.2.8",
          "port": {
            "443": 8443
          }
        }
      },
      "subjectAltNames": []
    },
    "/10.96.198.255": {
      "name": "productpage",
      "namespace": "default",
      "hostname": "productpage.default.svc.cluster.local",
      "vips": [
        "/10.96.198.255"

		},
		{
			service: "2001:1::1",
			valid:   true,
			name:    "pure ip6 address",
		},
		{
			service: "istio-pilot.istio-system.svc.cluster.local",
			valid:   true,
			name:    "standard kubernetes FQDN",
		},
		{
			service: "istio-pilot.istio-system.svc.cluster.local:3000",
			valid:   false,
			name:    "standard kubernetes FQDN with port",
		},
		{
			service: "bar/istio.io",
			valid:   true,

	// Determine if the service is in the format we expect
	// (servicePorts are present and service type matches)
	formatCorrect := checkServiceFormat(svc, servicePorts, serviceType)
	if formatCorrect {
		return svc, false
	}
	svc.Spec.Ports = servicePorts
	svc.Spec.Type = serviceType
	return svc, true
}

// Determine if the service is in the correct format
// getMasterServiceUpdateIfNeeded expects (servicePorts are correct

apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  annotations:
    internal.istio.io/gateway-semantics: gateway
    internal.istio.io/gateway-service: istio-ingressgateway.istio-system.svc.domain.suffix
    internal.istio.io/parents: Gateway/gateway/apple.istio-system
  creationTimestamp: null
  name: gateway-istio-autogenerated-k8s-gateway-apple
  namespace: istio-system
spec:
  servers:
  - hosts:
    - apple/apple.example

    - destination:
        host: foo-svc.default.svc.domain.suffix
        port:
          number: 8000
      headers:
        request:
          add:
            foo: bar
        response:
          add:
            response: header
  - match:
    - uri:
        prefix: /get
    name: default.http.0
    route:
    - destination:
        host: httpbin.default.svc.domain.suffix
        port:

	// nolint: lll
	ExpectedXfccHeader = `By=spiffe://cluster.local/ns/mounted-certs/sa/server;Hash=86948ccdaf2de73b20d389dc212aaf2d72f9f1ca239327cc2e8b05e61b1676d1;Subject="CN=client.mounted-certs.svc.cluster.local";URI=spiffe://cluster.local/ns/mounted-certs/sa/client;DNS=client.mounted-certs.svc`
)

func TestClientToServiceTls(t *testing.T) {
	framework.NewTest(t).
		Run(func(t framework.TestContext) {
			createObject(t, echo1NS.Name(), DestinationRuleConfigMutual)

	tests := []struct {
		in   string
		want bool
	}{
		{"kubernetes.default.svc", true},
		{"kubernetes.default.svc.cluster.local", true},
		{"https://kubernetes.default.svc", true},
		{"https://kubernetes.default.svc.cluster.local", true},
		{"foo.default.svc", false},
		{"foo.default.svc:80", false},
		{"https://foo.default.svc:80", false},
	}
	for _, tt := range tests {
		t.Run(tt.in, func(t *testing.T) {

  hostnames:
  - "bar.example.com"
  rules:
  - matches:
    - headers:
      - type: Exact
        name: env
        value: canary
    backendRefs:
    - name: bar-svc-canary
      port: 8080
  - backendRefs:
    - name: bar-svc

		{pod.Name, svc.Name, pod.Namespace, "1.2.3.4"},
		{"name-static", svc.Name, pod.Namespace, "9.9.9.9"},
	})

	ExtraSimplePods.Set(nil)
	assert.EventuallyEqual(t, fetch, []SimpleEndpoint{
		{pod.Name, svc.Name, pod.Namespace, "1.2.3.4"},
	})

	pod.Status.PodIP = "1.2.3.5"
	pc.UpdateStatus(pod)
	assert.EventuallyEqual(t, fetch, []SimpleEndpoint{{pod.Name, svc.Name, pod.Namespace, "1.2.3.5"}})