apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
  name: egressgateway-for-external-app
spec:
  host: istio-egressgateway.istio-system.svc.cluster.local
  trafficPolicy:
    portLevelSettings:
    - port:
        number: 443
      tls:
        mode: ISTIO_MUTUAL

                targetPort: 15017
                name: tls-webhook
              - port: 31400
                targetPort: 31400
                name: tcp
    # Enable the egressgateway for all tests by default.
    egressGateways:
      - name: istio-egressgateway

			value: "istio-egressgateway-certs",
		},
		{
			path:  "values.gateways.istio-egressgateway.secretVolumes[0].mountPath",
			value: "/etc/istio/egressgateway-certs",
		},
		{
			path:  "values.gateways.istio-egressgateway.secretVolumes[1].name",
			value: "egressgateway-ca-certs",
		},
		{
			path:  "values.gateways.istio-egressgateway.secretVolumes[1].secretName",

apiVersion: install.istio.io/v1alpha1
kind: IstioOperator
metadata:
  namespace: istio-system
spec:
  values:
    gateways:
      istio-egressgateway:
        secretVolumes:
          - mountPath: /etc/istio/egressgateway-certs

apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: {{ .EgressGatewayIstioLabel | default "egressgateway" }}
  namespace: {{ .EgressGatewayServiceNamespace | default .SystemNamespace.Name }}
spec:
  selector:
    matchLabels:
      app: {{ .EgressGatewayServiceName | default "istio-egressgateway" }}
  rules:
    - to: # only allow /allow for company.com
        - operation:
            paths: [ "/allow" ]

components.base.enabled=true
components.cni.enabled=false
components.egressGateways[0].enabled=false
components.egressGateways[0].name="istio-egressgateway"
components.ingressGateways[0].enabled=true
components.ingressGateways[0].name="istio-ingressgateway"
components.pilot.enabled=false
hub="gcr.io/istio-testing"
profile="default"
tag="latest"
values.defaultRevision=""
values.global.configValidation=true

  components:
    base:
      enabled: true
    pilot:
      enabled: true
    # Istio Gateway feature
    ingressGateways:
    - name: istio-ingressgateway
      enabled: true
    egressGateways:
    - name: istio-egressgateway
      enabled: false

  # Most default values come from the helm chart's values.yaml
  # Below are the things that differ
  values:
    defaultRevision: ""
    global:

apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
  name: istio-multicluster-egressgateway
  namespace: istio-system
spec:
   # workloadLabels is deprecated
   workloadLabels:
     istio: egressgateway
   # filters is deprecated
   filters:
   - listenerMatch:
       portNumber: 15443
---
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: productpage
  namespace: foo
spec:

  gateways:
    istio-ingressgateway:
      autoscaleEnabled: true
    istio-egressgateway:
      autoscaleEnabled: true
components:
  pilot:
    k8s:
      replicaCount: 2
  ingressGateways:
    - name: istio-ingressgateway
      enabled: true
      k8s:
        replicaCount: 2
  egressGateways:
    - name: istio-egressgateway
      enabled: true
      k8s:

	if cfg == nil {
		return
	}
	cfg.ControlPlaneValues = tmpl.MustEvaluate(`
{{- if not .isExternalControlPlane }}
components:
  egressGateways:
  - enabled: true
    name: istio-egressgateway
values:
   gateways:
      istio-egressgateway:
         secretVolumes:
         - name: client-custom-certs
           secretName: egress-gw-cacerts
           mountPath: /etc/certs/custom
{{- end }}