tcp1: 7070
---

# TODO: in progres, should bind to 127.0.0.1
# will resolve using SNI
# DNS or etc/hosts or code must override the address, but pass proper SNI
apiVersion: networking.istio.io/v1alpha3
kind: ServiceEntry
metadata:
  name: https
  namespace: none
spec:
  hosts:
  # TODO: Bug: without isolation (in the main test) it causes 'duplicated cluster', envoy rejects config

    internal.istio.io/parents: Gateway/eastwestgateway/istiod-grpc.istio-system
  creationTimestamp: null
  name: eastwestgateway-istio-autogenerated-k8s-gateway-istiod-grpc
  namespace: istio-system
spec:
  servers:
  - hosts:
    - istio-system/*
    port:
      name: default
      number: 15012
      protocol: TLS
    tls: {}
---
apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  annotations:

apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: reviews
spec:
  hosts:
  - reviews
  http:
  - route:
    - destination:
        host: reviews
        subset: v3
---
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: ratings
spec:
  hosts:
  - ratings
  http:
  - route:
    - destination:
        host: ratings
        subset: v2-mysql

apiVersion: networking.istio.io/v1alpha3
kind: ServiceEntry
metadata:
  name: websocket-extsvc
  namespace: testns
spec:
   hosts:
   - websocket.test.istio.io
   ports:
   - number: 9002
     name: http
     protocol: HTTP
   resolution: STATIC
   endpoints:
    - address: 127.0.0.2
      ports:
        http: 7072
      labels:
        version: v1

---
apiVersion: networking.istio.io/v1alpha3

  servers:
  - port:
      number: 80
      name: http
      protocol: HTTP
    hosts:
    - uk.bookinfo.com
    - eu.bookinfo.com
    - c.foo
    tls:
      httpsRedirect: true # sends 302 redirect for http requests
  - port:
      number: 443
      name: https
      protocol: HTTPS
    hosts:
    - uk.bookinfo.com
    - eu.bookinfo.com
    tls:
      mode: SIMPLE #enables HTTPS on this port

apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: reviews
spec:
  hosts:
  - reviews
  http:
  - route:
    - destination:
        host: reviews
        subset: v3
---
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: ratings
spec:
  hosts:
  - ratings
  http:
  - route:
    - destination:
        host: ratings
        subset: v2-mysql-vm

apiVersion: networking.istio.io/v1alpha3
kind: Sidecar
metadata:
  name: default-sidecar-scope
  namespace: istio-config
spec:
  egress:
  - hosts:
    - "./*"
---
# Authentication policy to enable mutual TLS for all services (that have sidecar) in the mesh.
apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
  name: default
  namespace: istio-config
spec:
  mtls:
    mode: STRICT
---

spec:
  selector:
    istio: ingressgateway
  servers:
  - port:
      number: 80
      name: http
      protocol: HTTP
    hosts:
    - "*"
---
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: httpbin
spec:
  hosts:
  - "*"
  gateways:
  - httpbin-gateway
  http:
  - route:
    - destination:
        host: httpbin
        port:

    istio.io/benchmark: "true"
  servers:
  - port:
      number: 80
      name: http
      protocol: HTTP
    hosts:
    - random-1.host.example
    - random-2.host.example
    - random-3.host.example
  - port:
      number: 443
      name: https
      protocol: HTTPS
    hosts:
    - random-1.host.example
    - random-2.host.example
    - random-3.host.example
    tls:
      mode: ISTIO_MUTUAL
---

metadata:
  name: external-svc-dst
  namespace: testns
spec:
   hosts:
   - dst.extsvc.com
#   - *.dst2.extsvc.com
   ports:
   - number: 8001
     name: extsvc-http
     protocol: HTTP
   resolution: NONE

---


apiVersion: networking.istio.io/v1alpha3
kind: ServiceEntry
metadata:
  name: external-svc-ep
  namespace: testns
spec:
   hosts:
   - ep.extsvc.com
   ports:
   - number: 8002