internal.istio.io/parents: Gateway/eastwestgateway/istiod-grpc.istio-system
  creationTimestamp: null
  name: eastwestgateway-istio-autogenerated-k8s-gateway-istiod-grpc
  namespace: istio-system
spec:
  servers:
  - hosts:
    - istio-system/*
    port:
      name: default
      number: 15012
      protocol: TLS
    tls: {}
---
apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  annotations:

    internal.istio.io/parents: Gateway/gateway/passthrough.istio-system
  creationTimestamp: null
  name: gateway-istio-autogenerated-k8s-gateway-passthrough
  namespace: istio-system
spec:
  servers:
  - hosts:
    - '*/*'
    port:
      name: default
      number: 34000
      protocol: TLS
    tls: {}
---
apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  annotations:

					protocol: protocol.HTTP,
				},
			},
		},
		{
			name: "Duplicate hosts in TLS filterChain",
			node: &pilot_model.Proxy{Metadata: &pilot_model.NodeMetadata{}},
			server: &networking.Server{
				Port: &networking.Port{
					Protocol: "HTTPS",
				},
				Hosts: []string{"example.org", "example.org"},
				Tls: &networking.ServerTLSSettings{

    internal.istio.io/parents: Gateway/gateway/apple.istio-system
  creationTimestamp: null
  name: gateway-istio-autogenerated-k8s-gateway-apple
  namespace: istio-system
spec:
  servers:
  - hosts:
    - apple/apple.example
    port:
      name: default
      number: 80
      protocol: HTTP
---
apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  annotations:

  rules:
    - to: # only allow /allow for company.com
        - operation:
            paths: [ "/allow" ]
            hosts: [ "www.company.com" ]
    - to: # checks only a call 443 over istio mutual without JWT
        - operation:
            hosts: [ "{{ .Allowed.ServiceName }}-{{ .Allowed.NamespaceName }}-only.com" ]
      from:
        - source:

	hosts := sets.Set[string]{}
	if g == nil {
		return hosts
	}
	if g.ContainsAutoPassthroughGateways {
		for _, tls := range g.MergedServers {
			for _, s := range tls.Servers {
				if s.GetTls().GetMode() == networking.ServerTLSSettings_AUTO_PASSTHROUGH {
					hosts.InsertAll(s.Hosts...)
				}
			}
		}
	}
	return hosts
}

apiVersion: networking.istio.io/v1alpha3
kind: ServiceEntry
metadata:
  name: external-reviews
  namespace: default
spec:
  hosts:
  - external-reviews.org
---
apiVersion: networking.istio.io/v1alpha3
kind: ServiceEntry
metadata:
  name: eu-wildcard
  namespace: default
spec:
  hosts:
  - "*.eu.bookinfo.com"
---
apiVersion: networking.istio.io/v1alpha3
kind: ServiceEntry
metadata:

    internal.istio.io/parents: Gateway/gateway/default.istio-system
  creationTimestamp: null
  name: gateway-istio-autogenerated-k8s-gateway-default
  namespace: istio-system
spec:
  servers:
  - hosts:
    - '*/*.domain.example'
    port:
      name: default
      number: 80
      protocol: HTTP
---
apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  annotations:

          # don't overwrite /etc/hosts since it's managed by kubeproxy
          #sudo sh -c 'cat /var/run/secrets/istio/bootstrap/hosts >> /etc/hosts'

          # since we're not overwriting /etc/hosts on k8s, verify that istiod hostname in /etc/hosts
          # matches the value generated by istioctl
          echo "checking istio host"
          SYSTEM_HOST=$(cat /etc/hosts | grep istiod)

				ServiceSettings: []*meshconfig.MeshConfig_ServiceSettings{
					{
						Settings: &meshconfig.MeshConfig_ServiceSettings_Settings{
							ClusterLocal: false,
						},
						Hosts: []string{"*.kube-system.svc.cluster.local"},
					},
				},
			},
			host:     "s.kube-system.svc.cluster.local",
			expected: false,
		},
		{
			name: "override default service",
			m: &meshconfig.MeshConfig{