`).
		YAML("", fmt.Sprintf(`
apiVersion: gateway.networking.k8s.io/v1beta1
kind: Gateway
metadata:
  name: gateway
  namespace: istio-system
spec:
  addresses:
  - value: istio-ingressgateway
    type: Hostname
  gatewayClassName: custom-istio
  listeners:
  - name: http
    hostname: "*.domain.example"
    port: 80
    protocol: HTTP
    allowedRoutes:
      namespaces:

spec:
  controllerName: istio.io/gateway-controller
---
apiVersion: gateway.networking.k8s.io/v1beta1
kind: Gateway
metadata:
  name: gateway
  namespace: istio-system
spec:
  addresses:
  - value: istio-ingressgateway
    type: Hostname
  gatewayClassName: istio
  listeners:
  - name: default
    hostname: "*.domain.example"
    port: 80
    protocol: HTTP
    allowedRoutes:
      namespaces:
        from: All

  - lastTransitionTime: fake
    message: Resource accepted
    reason: Accepted
    status: "True"
    type: Accepted
  - lastTransitionTime: fake
    message: Resource programmed, assigned to service(s) istio-ingressgateway.istio-system.svc.domain.suffix:34000
    reason: Programmed
    status: "True"
    type: Programmed
  listeners:
  - attachedRoutes: 2
    conditions:
    - lastTransitionTime: fake

	appName         = "opentelemetry-collector"
	remoteOtelEntry = `
apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: otel-gateway
  namespace: istio-system
spec:
  selector:
    istio: ingressgateway
  servers:
  - port:
      number: 55678
      name: http-tracing-span
      protocol: HTTP
    hosts:
    - "opentelemetry-collector.{INGRESS_DOMAIN}"
---
apiVersion: networking.istio.io/v1alpha3

// DEFAULT allows Ingress without explicit class.

// In 1.1:
// - K8S_INGRESS_NS - namespace of the Gateway that will act as ingress.
// - labels of the gateway set to "app=ingressgateway" for node_port, service set to 'ingressgateway' (matching default install)
//   If we need more flexibility - we can add it (but likely we'll deprecate ingress support first)
// -

var schemas = collection.SchemasFor(

		return true
	})
}

func (*IngressGatewayPortAnalyzer) analyzeGateway(r *resource.Instance, c analysis.Context) {
	gw := r.Message.(*v1alpha3.Gateway)

	// Typically there will be a single istio-ingressgateway service, which will select
	// the same ingress gateway pod workload as the Gateway resource.  If there are multiple
	// Kubernetes services, and they offer different TCP port combinations, this validator will

		inputFiles: []string{"testdata/gateway-custom-ingressgateway.yaml"},
		analyzer:   &gateway.IngressGatewayPortAnalyzer{},
		expected:   []message{
			// no messages, this test case verifies no false positives
		},
	},
	{
		name:       "gatewayCustomIngressGatewayBadPort",
		inputFiles: []string{"testdata/gateway-custom-ingressgateway-badport.yaml"},
		analyzer:   &gateway.IngressGatewayPortAnalyzer{},

apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  annotations:
    internal.istio.io/gateway-semantics: gateway
    internal.istio.io/gateway-service: istio-ingressgateway.istio-system.svc.domain.suffix
    internal.istio.io/parents: Gateway/gateway/default.istio-system
  creationTimestamp: null
  name: gateway-istio-autogenerated-k8s-gateway-default
  namespace: istio-system
spec:
  servers:
  - hosts:
    - '*/*.example.com'

  - lastTransitionTime: fake
    message: Resource accepted
    reason: Accepted
    status: "True"
    type: Accepted
  - lastTransitionTime: fake
    message: Resource programmed, assigned to service(s) istio-ingressgateway.istio-system.svc.domain.suffix:80
    reason: Programmed
    status: "True"
    type: Programmed
  listeners:
  - attachedRoutes: 8
    conditions:
    - lastTransitionTime: fake
      message: No errors found

var services = []*model.Service{
	{
		Attributes: model.ServiceAttributes{
			Name:      "istio-ingressgateway",
			Namespace: "istio-system",
			ClusterExternalAddresses: &model.AddressMap{
				Addresses: map[cluster.ID][]string{
					constants.DefaultClusterName: {"1.2.3.4"},
				},
			},
		},
		Ports:    ports,
		Hostname: "istio-ingressgateway.istio-system.svc.domain.suffix",
	},
	{
		Attributes: model.ServiceAttributes{