apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: reviews
spec:
  hosts:
  - reviews
  http:
  - route:
    - destination:
        host: reviews
        subset: v3
---
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: ratings
spec:
  hosts:
  - ratings
  http:
  - route:
    - destination:
        host: ratings
        subset: v2-mysql-vm

apiVersion: networking.istio.io/v1alpha3
kind: Sidecar
metadata:
  name: default-sidecar-scope
  namespace: istio-config
spec:
  egress:
  - hosts:
    - "./*"
---
# Authentication policy to enable mutual TLS for all services (that have sidecar) in the mesh.
apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
  name: default
  namespace: istio-config
spec:
  mtls:
    mode: STRICT
---

    internal.istio.io/parents: Gateway/eastwestgateway/istiod-grpc.istio-system
  creationTimestamp: null
  name: eastwestgateway-istio-autogenerated-k8s-gateway-istiod-grpc
  namespace: istio-system
spec:
  servers:
  - hosts:
    - istio-system/*
    port:
      name: default
      number: 15012
      protocol: TLS
    tls: {}
---
apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  annotations:

spec:
  selector:
    istio: ingressgateway
  servers:
  - port:
      number: 80
      name: http
      protocol: HTTP
    hosts:
    - "*"
---
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: httpbin
spec:
  hosts:
  - "*"
  gateways:
  - httpbin-gateway
  http:
  - route:
    - destination:
        host: httpbin
        port:

    istio.io/benchmark: "true"
  servers:
  - port:
      number: 80
      name: http
      protocol: HTTP
    hosts:
    - random-1.host.example
    - random-2.host.example
    - random-3.host.example
  - port:
      number: 443
      name: https
      protocol: HTTPS
    hosts:
    - random-1.host.example
    - random-2.host.example
    - random-3.host.example
    tls:
      mode: ISTIO_MUTUAL
---

metadata:
  name: external-svc-dst
  namespace: testns
spec:
   hosts:
   - dst.extsvc.com
#   - *.dst2.extsvc.com
   ports:
   - number: 8001
     name: extsvc-http
     protocol: HTTP
   resolution: NONE

---


apiVersion: networking.istio.io/v1alpha3
kind: ServiceEntry
metadata:
  name: external-svc-ep
  namespace: testns
spec:
   hosts:
   - ep.extsvc.com
   ports:
   - number: 8002

	if efw == nil {
		return true
	}
	for _, cp := range efw.Patches[networking.EnvoyFilter_CLUSTER] {
		if cp.Operation != networking.EnvoyFilter_Patch_REMOVE {
			continue
		}
		if commonConditionMatch(pctx, cp) && clusterMatch(c, cp, hosts) {
			return false
		}
	}
	return true
}

	testCases := map[string]struct {
		hosts       string
		expectedExt *pkix.Extension
	}{
		"URI host": {
			hosts:       "spiffe://test.domain.com/ns/default/sa/default",
			expectedExt: getSANExtension([]Identity{uriIdentity}, t),
		},
		"IP host": {
			hosts:       "10.0.0.1",
			expectedExt: getSANExtension([]Identity{ipIdentity}, t),
		},
		"DNS host": {
			hosts:       "test.domain.com",

  servers:
  - port:
      number: 80
      name: http
      protocol: HTTP
    hosts:
    - uk.bookinfo.com
    - eu.bookinfo.com
    - c.foo
    tls:
      httpsRedirect: true # sends 302 redirect for http requests
  - port:
      number: 443
      name: https
      protocol: HTTPS
    hosts:
    - uk.bookinfo.com
    - eu.bookinfo.com
    tls:
      mode: SIMPLE #enables HTTPS on this port

  servers:
  - port:
      number: 80
      name: tcp
      protocol: TCP
    hosts:
    - "foo.bar"
---
apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: alpha
spec:
  selector:
    istio: ingressgateway
  servers:
  - port:
      number: 80
      name: http
      protocol: HTTP
    hosts: