spec:
  selector:
    istio: {{.GatewayIstioLabel | default "ingressgateway"}}
  servers:
  - port:
      number: 80
      name: http
      protocol: HTTP
    hosts:
    - "*"
    tls:
      httpsRedirect: true
---
apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
  name: ingressgateway-redirect-config
  namespace: {{.SystemNamespace | default "istio-system"}}

		},
		{
			name: "ingress",
			node: &Proxy{
				ConfigNamespace: "other",
				Labels: map[string]string{
					"istio": "ingressgateway",
				},
				Metadata: &NodeMetadata{
					Labels: map[string]string{
						"istio": "ingressgateway",
					},
				},
			},
			listenerInfo: anyListener,
			pluginType:   WasmPluginTypeHTTP,

			})
		})
}

func TestAuthZCheck(t *testing.T) {
	// nolint: staticcheck
	framework.NewTest(t).RequiresSingleCluster().
		Run(func(t framework.TestContext) {
			istioLabel := "ingressgateway"
			if labelOverride := i.Settings().IngressGatewayIstioLabel; labelOverride != "" {
				istioLabel = labelOverride
			}
			t.ConfigIstio().File(apps.Namespace.Name(), "testdata/authz-a.yaml").ApplyOrFail(t)

  variant: %q
profile: ambient
`
	sampleEnvoyFilter = `
apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
  name: sample
spec:
  workloadSelector:
    labels:
      istio: ingressgateway
  configPatches:
  - applyTo: NETWORK_FILTER # http connection manager is a filter in Envoy
    match:
      context: GATEWAY
      listener:
        filterChain:
          sni: app.example.com

			// Apply config to make this not invalid
			t.ConfigIstio().YAML(ns.Name(), `
apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: missing-gw
spec:
  selector:
    istio: ingressgateway
  servers:
  - port:
      number: 80
      name: http
      protocol: HTTP
    hosts:
    - "*"
`).ApplyOrFail(t)
			// Status should no longer report error

						return fmt.Errorf("fail to delete iop")
					}

					return nil
				}, retry.Timeout(deletionTimeout), retry.Delay(retryDelay))
			})

			// For negative casse, use default profile, ingressgateway alway connect to istiod
			// deletion will fail
			t.NewSubTest("delete-iop-fail").Run(func(t framework.TestContext) {
				istioCtl := istioctl.NewOrFail(t, t, istioctl.Config{})

							},
						},
						Gateways: []*meshconfig.Network_IstioNetworkGateway{
							{
								Gw: &meshconfig.Network_IstioNetworkGateway_RegistryServiceName{
									RegistryServiceName: "istio-ingressgateway.istio-system.svc.cluster.local",
								},
								Port: 80,
							},
						},
					},
					"n2": {
						Endpoints: []*meshconfig.Network_NetworkEndpoints{
							{

	// Controls whether any gateways are enabled.
	Enabled *wrapperspb.BoolValue `protobuf:"bytes,2,opt,name=enabled,proto3" json:"enabled,omitempty"`
	// Configuration for an ingress gateway.
	IstioIngressgateway *IngressGatewayConfig `protobuf:"bytes,4,opt,name=istio_ingressgateway,json=istio-ingressgateway,proto3" json:"istio_ingressgateway,omitempty"`

    #     - registryServiceName: istio-ingressgateway.istio-system.svc.cluster.local
    #       port: 443
    #
    meshNetworks: {}

    # Use the user-specified, secret volume mounted key and certs for Pilot and workloads.
    mountMtlsCerts: false

    multiCluster:
      # Set to true to connect two kubernetes clusters via their respective
      # ingressgateway services when pods in each cluster cannot directly

    #     gateways:
    #     - registryServiceName: istio-ingressgateway.istio-system.svc.cluster.local
    #       port: 443
    #
    meshNetworks: {}
    # Use the user-specified, secret volume mounted key and certs for Pilot and workloads.
    mountMtlsCerts: false
    multiCluster:
      # Set to true to connect two kubernetes clusters via their respective
      # ingressgateway services when pods in each cluster cannot directly