when := "createNewContext"
	newPush := NewPushContext()
	newPush.Mesh = env.Mesh()
	newPush.InitContext(env, nil, nil)
	verifyServices(true, fmt.Sprintf(testDesc, otherNS, when), otherNS, newPush)
	verifyServices(true, fmt.Sprintf(testDesc, defaultNS, when), defaultNS, newPush)

	oldPush := newPush
	newPush = NewPushContext()
	newPush.Mesh = env.Mesh()
	svcName := "svc6.foo.cluster.local"

kind: VirtualService
metadata:
  name: route-via-egressgateway
  namespace: {{ .From.NamespaceName }}
spec:
  hosts:
    - "www.company.com"
  gateways:
    - test-egress
    - mesh
  http:
    - match:
        - gateways:
            - mesh
          port: 80
      route:
        - destination:

// limitations under the License.

package xds

import (
	discovery "github.com/envoyproxy/go-control-plane/envoy/service/discovery/v3"

	mesh "istio.io/api/mesh/v1alpha1"
	"istio.io/istio/pilot/pkg/features"
	"istio.io/istio/pilot/pkg/model"
	tb "istio.io/istio/pilot/pkg/trustbundle"
	"istio.io/istio/pilot/pkg/util/protoconv"
)

	c.PersistentFlags().StringVar(&serverArgs.MeshConfigFile, "meshConfig", "./etc/istio/config/mesh",
		"File name for Istio mesh configuration. If not specified, a default mesh will be used.")
	c.PersistentFlags().StringVar(&serverArgs.NetworksConfigFile, "networksConfig", "./etc/istio/config/meshNetworks",
		"File name for Istio mesh networks configuration. If not specified, a default mesh networks will be used.")

	v = AppendValidation(v, validateServiceSettings(mesh))
	v = AppendValidation(v, validateTrustDomainConfig(mesh))

	if err := validateExtensionProvider(mesh); err != nil {
		scope.Warnf("found invalid extension provider (can be ignored if the given extension provider is not used): %v", err)
	}

	v = AppendValidation(v, ValidateMeshTLSConfig(mesh))

As ztunnel aims to transparently encrypt and route users traffic, we need a mechanism to capture all traffic entering and leaving "mesh" pods.
This is a security critical task: if the ztunnel can be bypassed, authorization policies can be bypassed.

Redirection must meet these requirements:
* All traffic *egressing* a pod in the mesh should be redirected to the node-local ztunnel on port 15001.

	apNs := r.Metadata.FullName.Namespace.String()

	// If AuthzPolicy is mesh-wide
	if meshWidePolicy(apNs, c) {
		// If it has selector, need further analysis
		if ap.GetSelector() != nil {
			apSelector := klabels.SelectorFromSet(ap.GetSelector().MatchLabels)
			// If there is at least one pod matching the selector within the whole mesh
			if !hasMatchingPodsRunning(apSelector, podLabelsMap) {

	"github.com/google/uuid"
	uberatomic "go.uber.org/atomic"
	"google.golang.org/grpc"
	"google.golang.org/grpc/codes"
	"google.golang.org/grpc/status"
	"google.golang.org/protobuf/types/known/durationpb"

	mesh "istio.io/api/mesh/v1alpha1"
	"istio.io/istio/pilot/pkg/util/protoconv"
	"istio.io/istio/pkg/backoff"
	"istio.io/istio/pkg/log"
	"istio.io/istio/pkg/model"
	"istio.io/istio/pkg/security"
	"istio.io/istio/pkg/xds"
)

apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: mesh-route-outbound-traffic-to-external-svc-via-egress-gw
spec:
  hosts:
  - external.{{ .externalNamespace }}.svc.cluster.local
  gateways:
  - mesh
  tcp:
  - match:
    - port: {{ .externalSvcTcpPort }}
    route:
    - destination:

								Sni:  "custom.sni.com",
							},
						},
					},
				},
			},
		},
	}

	mesh := testMesh()
	mesh.EnableAutoMtls.Value = true

	clusters := buildTestClusters(clusterTest{t: t, serviceHostname: TestServiceNHostname, nodeType: model.SidecarProxy, mesh: mesh, destRule: destRule})

	tlsContext := getTLSContext(t, clusters[1])
	g.Expect(tlsContext).ToNot(BeNil())