apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: direct-cnn-through-egress-gateway
spec:
  hosts:
  - fake.external.com
  gateways:
  - istio-egressgateway
  - mesh
  tls:
  - match:
    - gateways:
      - mesh
      port: 443
      sniHosts:
      - fake.external.com
    route:
    - destination:
        host: istio-egressgateway.istio-system.svc.cluster.local
        port:

			tweakIngress: func(ingress *networking.Ingress) {
				ingress.Spec.IngressClassName = utilpointer.String("foo")
				ingress.Annotations = map[string]string{annotationIngressClass: "foo"}
			},
			expectedErrs: field.ErrorList{},
		},
		"class field and annotation set with different value": {
			tweakIngress: func(ingress *networking.Ingress) {
				ingress.Spec.IngressClassName = utilpointer.String("bar")

	// Currently supported values are "controlplane", "master", "etcd" and "cluster"
	// The "master" egress selector is deprecated in favor of "controlplane"
	Name string `json:"name"`

	// connection is the exact information used to configure the egress selection
	Connection Connection `json:"connection"`
}

// Connection provides the configuration for a single egress selection client.
type Connection struct {

default based on the existence of Ingress or Egress rules; policies that contain an Egress section are assumed to affect Egress, and all policies (whether or not they contain an Ingress section) are assumed to affect Ingress. If you want to write an egress-only policy, you must explicitly specify policyTypes [ \"Egress\" ]. Likewise, if you want to write a policy that specifies that no egress is allowed, you must specify a policyTypes value that include \"Egress\" (since such a policy would not include...

func SetDefaults_NetworkPolicy(obj *networkingv1.NetworkPolicy) {
	if len(obj.Spec.PolicyTypes) == 0 {
		// Any policy that does not specify policyTypes implies at least "Ingress".
		obj.Spec.PolicyTypes = []networkingv1.PolicyType{networkingv1.PolicyTypeIngress}
		if len(obj.Spec.Egress) != 0 {
			obj.Spec.PolicyTypes = append(obj.Spec.PolicyTypes, networkingv1.PolicyTypeEgress)
		}
	}
}

            "ipBlock": {
              "cidr": "cidrValue",
              "except": [
                "exceptValue"
              ]
            }
          }
        ]
      }
    ],
    "egress": [
      {
        "ports": [
          {
            "protocol": "protocolValue",
            "port": "portValue",
            "endPort": 3
          }
        ],
        "to": [
          {

    blockOwnerDeletion: true
    controller: true
    kind: kindValue
    name: nameValue
    uid: uidValue
  resourceVersion: resourceVersionValue
  selfLink: selfLinkValue
  uid: uidValue
spec:
  egress:
  - ports:
    - endPort: 3
      port: portValue
      protocol: protocolValue
    to:
    - ipBlock:
        cidr: cidrValue
        except:
        - exceptValue
      namespaceSelector:

            "ipBlock": {
              "cidr": "cidrValue",
              "except": [
                "exceptValue"
              ]
            }
          }
        ]
      }
    ],
    "egress": [
      {
        "ports": [
          {
            "protocol": "protocolValue",
            "port": "portValue",
            "endPort": 3
          }
        ],
        "to": [
          {

            "ipBlock": {
              "cidr": "cidrValue",
              "except": [
                "exceptValue"
              ]
            }
          }
        ]
      }
    ],
    "egress": [
      {
        "ports": [
          {
            "protocol": "protocolValue",
            "port": "portValue",
            "endPort": 3
          }
        ],
        "to": [
          {

// routed to egress-gateway service in istio-system namespace and then from egress-gateway to server in server namespace.
// TLS origination at Gateway happens using DestinationRule with CredentialName reading k8s secret at the gateway proxy.
func newTLSGateway(t test.Failer, ctx resource.Context, clientNamespace namespace.Instance,
	to echo.Instances, egressNs string, egressSvc string, egressLabel string,
) {