apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: tls
  namespace: bar
spec:
  rules:
    - host: foo.org
      http:
        paths:
          - backend:
              service:
                name: httpbin
                port:
                  number: 80
            path: /*
  tls:
    - hosts:

kind: DestinationRule
metadata:
  name: egressgateway-for-external-app
spec:
  host: istio-egressgateway.istio-system.svc.cluster.local
  trafficPolicy:
    portLevelSettings:
    - port:
        number: 443
      tls:
        mode: ISTIO_MUTUAL

apiVersion: release-notes/v2
kind: feature
area: traffic-management
issue:
  - https://github.com/istio/istio/issues/36271
releaseNotes:
  - |

#$ Used in:
#$ - site-src/v1alpha2/guides/tls.md
apiVersion: gateway.networking.k8s.io/v1beta1
kind: Gateway
metadata:
  name: cross-namespace-tls-gateway
  namespace: gateway-api-example-ns1
spec:
  gatewayClassName: acme-lb
  listeners:
  - name: https
    protocol: HTTPS
    port: 443
    hostname: "*.example.com"
    tls:
      certificateRefs:
      - kind: Secret
        group: ""
        name: wildcard-example-com-cert

apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  annotations:
    internal.istio.io/route-semantics: ingress
  creationTimestamp: null
  name: foo-org-tls-istio-autogenerated-k8s-ingress
  namespace: bar
spec:
  gateways:
  - istio-system/tls-istio-autogenerated-k8s-ingress-bar
  hosts:
  - foo.org
  http:
  - route:
    - destination:
        host: httpbin.bar.svc.mydomain
        port:

			namespace: "default",
			cert:      "tls-mtls-cert",
			key:       "tls-mtls-key",
			caCert:    "tls-mtls-ca",
		},
		{
			name:      "tls-mtls-crl",
			namespace: "default",
			cert:      "tls-mtls-cert",
			key:       "tls-mtls-key",
			caCert:    "tls-mtls-ca",
			crl:       "tls-mtls-crl",
			caCrl:     "tls-mtls-crl",
		},
		{
			name:            "tls-mtls-split",

apiVersion: release-notes/v2
kind: feature
area: security
issue:
  - https://github.com/istio/api/issues/2285
releaseNotes:
  - |

 resolution: STATIC
 ports:
 - name: http
   number: 8000
   protocol: HTTP
---`
	mkCall := func(port int, tls simulation.TLSMode) simulation.Call {
		r := simulation.Call{Protocol: simulation.HTTP, Port: port, CallMode: simulation.CallModeInbound, TLS: tls}
		if tls == simulation.MTLS {
			r.Alpn = "istio"
		}
		return r
	}
	cases := []struct {
		name   string
		config string

			return inboundPlainTextTCPFilterChainMatchOptions
		}
	}
}

func (opt FilterChainMatchOptions) ToTransportSocket(mtls authn.MTLSSettings) *tls.DownstreamTlsContext {
	if !opt.TLS {
		return nil
	}
	if opt.Protocol == networking.ListenerProtocolHTTP {
		return mtls.HTTP
	}
	return mtls.TCP

apiVersion: gateway.networking.k8s.io/v1beta1
kind: HTTPRoute
metadata:
  name: tls-redirect
spec:
  parentRefs:
  - name: example-gateway
    sectionName: http
  hostnames:
  - foo.example.com
  - bar.example.com
  rules:
  - filters:
    - type: RequestRedirect
      requestRedirect:
        scheme: https