kind: feature
area: documentation
issue:
  - 40405

releaseNotes:
- |

apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: bookinfo-application
  namespace: argocd
  finalizers:
  - resources-finalizer.argocd.argoproj.io
spec:
  destination:
    name: ambient-cluster
    namespace: ambient
  source:
    path: application
    repoURL: '{repo-placeholder}'
    targetRevision: HEAD
    directory:
      exclude: application.yaml
  project: default
  syncPolicy:
    automated:

apiVersion: release-notes/v2
kind: feature
area: documentation
releaseNotes:
  - |

		Example: `  # Wait until the bookinfo virtual service has been distributed to all proxies in the mesh
  istioctl experimental wait --for=distribution virtualservice bookinfo.default

  # Wait until the bookinfo virtual service has been distributed to a specific proxy
  istioctl experimental wait --for=distribution virtualservice bookinfo.default --proxy workload-instance.namespace

apiVersion: gateway.networking.k8s.io/v1beta1
kind: Gateway
metadata:
  labels:
    istio.io/rev: rapid
  name: bookinfo-reviews
spec:
  gatewayClassName: istio-waypoint
  listeners:
  - name: mesh
    port: 15008

apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: gateway-bound-route
  namespace: testns
spec:
  hosts:
    - uk.bookinfo.com
  gateways:
  - istio-ingressgateway # pinned to ingress gateway only
  http:
    - route:
      - destination:
          host: c
          subset: v2
          port:
            number: 80

apiVersion: networking.istio.io/v1
kind: ServiceEntry
metadata:
  name: valid-service-entry
spec:
  hosts:
  - eu.bookinfo.com
  ports:
  - number: 80
    name: http
    protocol: HTTP
  resolution: DNS
  endpoints:
  # Rather than relying on an external host that might become unreachable (causing test failures)
  # we can mock the external endpoint using service t which has no sidecar.

apiVersion: networking.istio.io/v1beta1
kind: ServiceEntry
metadata:
  name: valid-service-entry
spec:
  hosts:
  - eu.bookinfo.com
  ports:
  - number: 80
    name: http
    protocol: HTTP
  resolution: DNS
  endpoints:
  # Rather than relying on an external host that might become unreachable (causing test failures)
  # we can mock the external endpoint using service t which has no sidecar.

e+5z6MTAO6ktvHdQlSuH6ARn47bJrZOlkttAhg==
-----END CERTIFICATE-----
`
)

var (
	testCsrHostName       = spiffe.Identity{TrustDomain: "cluster.local", Namespace: "default", ServiceAccount: "bookinfo-productpage"}.String()
	TestCACertFile        = "../testdata/example-ca-cert.pem"
	mismatchCertChainFile = "../testdata/cert-chain.pem"
)

func TestK8sSignWithMeshConfig(t *testing.T) {
	cases := []struct {

# Target: bookinfo sample
#-----------------------------------------------------------------------------

export BOOKINFO_VERSION ?= 1.18.0

.PHONY: bookinfo.build bookinfo.push

bookinfo.build:
	@prow/buildx-create
	@BOOKINFO_TAG=${BOOKINFO_VERSION} BOOKINFO_HUB=${HUB} samples/bookinfo/src/build-services.sh

bookinfo.push: MULTI_ARCH=true
bookinfo.push:
	@prow/buildx-create