gateways:
  # Pinned to both the sidecars (mesh) and egress gateway
  - istio-egressgateway
  - mesh
  http:
    - match:
      - gateways:
        - mesh # from sidecars, route to egress gateway service
      route:
      - destination:
          host: istio-egressgateway
        weight: 100
    - match:
      - gateways: # from egress gateway, route to actual external service

func BenchmarkSyscallExcess(b *testing.B) {
	benchmarkSyscall(b, 0, 4)
}

func BenchmarkSyscallExcessWork(b *testing.B) {
	benchmarkSyscall(b, 100, 4)
}

func benchmarkSyscall(b *testing.B, work, excess int) {
	b.SetParallelism(excess)
	b.RunParallel(func(pb *testing.PB) {
		foo := 42
		for pb.Next() {
			runtime.Entersyscall()
			for i := 0; i < work; i++ {
				foo *= 2
				foo /= 2
			}
			runtime.Exitsyscall()
		}

# config and certificate) `git clone ******@****.***:istio/api.git`

# HTTP and TLS, the host must be specified
# See https://istio.io/docs/tasks/traffic-management/egress/
apiVersion: networking.istio.io/v1alpha3
kind: ServiceEntry
metadata:
  name: github-https
spec:
  hosts:
  - github.com
  ports:
  - number: 443
    name: https
    protocol: HTTPS
---

apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: mesh-route-outbound-traffic-to-external-svc-via-egress-gw
spec:
  hosts:
  - external.{{ .externalNamespace }}.svc.cluster.local
  gateways:
  - mesh
  tcp:
  - match:
    - port: {{ .externalSvcTcpPort }}
    route:
    - destination:

### Examples

#### Egress Gateway

Deploying a Gateway to be used as an [Egress Gateway](https://istio.io/latest/docs/tasks/traffic-management/egress/egress-gateway/):

```yaml
service:
  # Egress gateways do not need an external LoadBalancer IP
  type: ClusterIP
```

#### Multi-network/VM Gateway

	// Version this sidecar was computed for
	Version string

	// Set of egress listeners, and their associated services.  A sidecar
	// scope should have either ingress/egress listeners or both.  For
	// every proxy workload that maps to a sidecar API object (or the
	// default object), we will go through every egress listener in the
	// object and process the Envoy listener or RDS based on the imported

#The following example demonstrates the use of a dedicated egress gateway
#through which all external service traffic is forwarded.


# Sidecar - no imports defined, isolated namespace.
apiVersion: networking.istio.io/v1alpha3
kind: Sidecar
metadata:
  name: default
  namespace: exampleegressgw
spec:
  egress:
  - hosts:
      - exampleegressgw/*
---
# Test workload entry
apiVersion: networking.istio.io/v1alpha3
kind: ServiceEntry

Using a namespace selector for dns egress traffic as shown [here](https://docs.projectcalico.org/security/tutorials/kubernetes-policy-advanced)
might not be enough since the node-local-dns pods run with `hostNetwork: True`

One way to enable connectivity from node-local-dns pods to clusterDNS ip is to use an ipBlock rule instead:

```
spec:
  egress:
  - ports:
    - port: 53
      protocol: TCP

	// +optional
	// +listType=atomic
	Egress []NetworkPolicyEgressRule `json:"egress,omitempty" protobuf:"bytes,3,rep,name=egress"`

	// policyTypes is a list of rule types that the NetworkPolicy relates to.
	// Valid options are ["Ingress"], ["Egress"], or ["Ingress", "Egress"].
	// If this field is not specified, it will default based on the existence of ingress or egress rules;

	// This field is beta-level in 1.8
	// +optional
	Egress []NetworkPolicyEgressRule

	// policyTypes is a list of rule types that the NetworkPolicy relates to.
	// Valid options are ["Ingress"], ["Egress"], or ["Ingress", "Egress"].
	// If this field is not specified, it will default based on the existence of ingress or egress rules;
	// policies that contain an egress section are assumed to affect egress, and all policies