apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: mesh-route-outbound-traffic-to-external-svc-via-egress-gw
spec:
  hosts:
  - external.{{ .externalNamespace }}.svc.cluster.local
  gateways:
  - mesh
  tcp:
  - match:
    - port: {{ .externalSvcTcpPort }}
    route:
    - destination:

apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: mesh-route-outbound-traffic-to-external-svc-via-egress-gw
spec:
  hosts:
  - external.{{ .externalNamespace }}.svc.cluster.local
  gateways:
  - mesh
  tcp:
  - match:
    - port: {{ .externalSvcTcpPort }}
    route:
    - destination:

kind: GatewayClass
metadata:
  name: default-match-example
spec:
  controllerName: acme.io/gateway-controller
---
apiVersion: gateway.networking.k8s.io/v1beta1
kind: Gateway
metadata:
  name: default-match-gw
spec:
  gatewayClassName: default-match-example
  listeners:
  - name: http
    protocol: HTTP
    port: 80
---
# This HTTPRoute demonstrates patch match defaulting. If no path match is

	"istio.io/istio/operator/pkg/util/progress"
	"istio.io/istio/pkg/kube"
	"istio.io/istio/pkg/test/util/assert"
)

var (
	//go:embed testdata/iop-test-gw-1.yaml
	iopTestGwData1 []byte
	//go:embed testdata/iop-test-gw-2.yaml
	iopTestGwData2 []byte
)

func applyResourcesIntoCluster(t *testing.T, h *HelmReconciler, manifestMap name.ManifestMap) {
	for cn, ms := range manifestMap.Consolidated() {

kind: Gateway
metadata:
  name: httpbin-gateway
spec:
  selector:
    istio: ingressgateway
---
apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: crossnamespace-gw
  namespace: another
spec:
  selector:
    istio: ingressgateway
---
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: httpbin
spec:
  hosts:
  - "*"
  gateways:

				Ne: &meshconfig.Network_NetworkEndpoints_FromRegistry{FromRegistry: "Kubernetes"},
			}},
			Gateways: []*meshconfig.Network_IstioNetworkGateway{{
				Port: 15443,
				Gw:   &meshconfig.Network_IstioNetworkGateway_RegistryServiceName{RegistryServiceName: "istio-meshnetworks-gw.istio-system.svc.cluster.local"},
			}},
		},
		"nw1": {
			Endpoints: []*meshconfig.Network_NetworkEndpoints{{

apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: mesh-route-outbound-traffic-to-external-svc-via-egress-gw
spec:
  hosts:
  - external.{{ .externalNamespace }}.svc.cluster.local
  gateways:
  - mesh
  tcp:
  - match:
    - port: {{ .externalSvcTcpPort }}
    route:
    - destination:

			// For now, we will treat all general route errors as "Ref" errors.
			conds[string(k8s.RouteConditionResolvedRefs)].error = gw.RouteError
		}
		if gw.DeniedReason != nil {
			conds[string(k8s.RouteConditionAccepted)].error = &ConfigError{
				Reason:  ConfigErrorReason(gw.DeniedReason.Reason),
				Message: gw.DeniedReason.Message,
			}
		}

		var currentConditions []metav1.Condition

		}
	}
	return
}

func validateGateways(gw []*v1alpha1.GatewaySpec, name string) util.Errors {
	// nolint: lll
	format := "port %v/%v in gateway %v invalid: targetPort is set to %d, which requires root. Set targetPort to be greater than 1024 or configure values.gateways.%s.runAsRoot=true"
	var errs util.Errors
	for _, gw := range gw {
		for _, p := range gw.GetK8S().GetService().GetPorts() {
			tp := 0
			if p == nil {

	servicePorts := map[uint32]bool{}
	portMapping := map[uint32]uint32{} // svc port -> svc targetPort mapping
	gwSelectorMatches := 0

	// For pods selected by gw.Selector, find Services that select them and remember those ports
	gwSelector := klabels.SelectorFromSet(gw.Selector)
	c.ForEach(gvk.Pod, func(rPod *resource.Instance) bool {
		podLabels := klabels.Set(rPod.Metadata.Labels)
		if gwSelector.Matches(podLabels) {
			gwSelectorMatches++