configured. See https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services ipFamilyPolicy: "" ipFamilies: [] secretVolumes: - name: egressgateway-certs secretName: istio-egressgateway-certs mountPath: /etc/istio/egressgateway-certs - name: egressgateway-ca-certs secretName: istio-egressgateway-ca-certs mountPath: /etc/istio/egressgateway-ca-certs configVolumes: [] additionalContainers: [] serviceAccount: # Annotations to add to the service account annotations: {} ### Advanced options...

apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
 name: istio-egressgateway
 namespace: exampleegressgw
spec:
 selector:
   istio: egressgateway
 servers:
 - port:
     number: 80
     name: http
     protocol: HTTP
   hosts:
   - "*"
---
#And the associated VirtualService to route from the sidecar to the
#gateway service (istio-egressgateway.istio-system.svc.cluster.local), as

  gateways:
  - mesh
  tcp:
  - match:
    - port: {{ .externalSvcTcpPort }}
    route:
    - destination:
        host: {{ .EgressGatewayServiceName | default "istio-egressgateway" }}.{{ .EgressGatewayServiceNamespace | default "istio-system" }}.svc.cluster.local
        port:
          number: 80
  tls:
  - match:
    - port: {{ .externalSvcTlsPort }}
      sniHosts:

apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: istio-egressgateway
spec:
  selector:
    istio: egressgateway
  servers:
  - port:
      number: 443
      name: mtls-tcp
      protocol: TLS
    hosts:
    - fake.external.com
    tls:

apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
  name: egressgateway-for-external-app
spec:
  host: istio-egressgateway.istio-system.svc.cluster.local
  trafficPolicy:
    portLevelSettings:
    - port:
        number: 443
      tls:
        mode: ISTIO_MUTUAL

apiVersion: install.istio.io/v1alpha1
kind: IstioOperator
metadata:
  namespace: istio-system
spec:
  values:
    gateways:
      istio-egressgateway:
        secretVolumes:
          - mountPath: /etc/istio/egressgateway-certs

			value: "istio-egressgateway-certs",
		},
		{
			path:  "values.gateways.istio-egressgateway.secretVolumes[0].mountPath",
			value: "/etc/istio/egressgateway-certs",
		},
		{
			path:  "values.gateways.istio-egressgateway.secretVolumes[1].name",
			value: "egressgateway-ca-certs",
		},
		{
			path:  "values.gateways.istio-egressgateway.secretVolumes[1].secretName",

apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: {{ .EgressGatewayIstioLabel | default "egressgateway" }}
  namespace: {{ .EgressGatewayServiceNamespace | default .SystemNamespace.Name }}
spec:
  selector:
    matchLabels:
      app: {{ .EgressGatewayServiceName | default "istio-egressgateway" }}
  rules:
    - to: # only allow /allow for company.com
        - operation:
            paths: [ "/allow" ]

apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
  name: istio-multicluster-egressgateway
  namespace: istio-system
spec:
   # workloadLabels is deprecated
   workloadLabels:
     istio: egressgateway
   # filters is deprecated
   filters:
   - listenerMatch:
       portNumber: 15443
---
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: productpage
  namespace: foo
spec:

[0].mountPath="/etc/istio/egressgateway-certs"