apiVersion: v2
name: istio-egress
# This version is never actually shipped. istio/release-builder will replace it at build-time
# with the appropriate version
version: 1.0.0
appVersion: 1.0.0
description: Helm chart for deploying Istio gateways
keywords:
  - istio
  - egressgateway
  - gateways
sources:
  - https://github.com/istio/istio

            "ipBlock": {
              "cidr": "cidrValue",
              "except": [
                "exceptValue"
              ]
            }
          }
        ]
      }
    ],
    "egress": [
      {
        "ports": [
          {
            "protocol": "protocolValue",
            "port": "portValue",
            "endPort": 3
          }
        ],
        "to": [
          {

            "ipBlock": {
              "cidr": "cidrValue",
              "except": [
                "exceptValue"
              ]
            }
          }
        ]
      }
    ],
    "egress": [
      {
        "ports": [
          {
            "protocol": "protocolValue",
            "port": "portValue",
            "endPort": 3
          }
        ],
        "to": [
          {

        from: All
    tls:
      mode: Terminate
      certificateRefs:
      - name: my-cert-http
      options:
        gateway.istio.io/tls-terminate-mode: MUTUAL
  - name: terminate-istio-mtls
    hostname: "egress.example"
    port: 34000
    protocol: HTTPS
    allowedRoutes:
      namespaces:
        from: All
    tls:
      mode: Terminate
      options:
        gateway.istio.io/tls-terminate-mode: ISTIO_MUTUAL

    blockOwnerDeletion: true
    controller: true
    kind: kindValue
    name: nameValue
    uid: uidValue
  resourceVersion: resourceVersionValue
  selfLink: selfLinkValue
  uid: uidValue
spec:
  egress:
  - ports:
    - endPort: 3
      port: portValue
      protocol: protocolValue
    to:
    - ipBlock:
        cidr: cidrValue
        except:
        - exceptValue
      namespaceSelector:

    blockOwnerDeletion: true
    controller: true
    kind: kindValue
    name: nameValue
    uid: uidValue
  resourceVersion: resourceVersionValue
  selfLink: selfLinkValue
  uid: uidValue
spec:
  egress:
  - ports:
    - endPort: 3
      port: portValue
      protocol: protocolValue
    to:
    - ipBlock:
        cidr: cidrValue
        except:
        - exceptValue
      namespaceSelector:

	}

	// Restrict egress from this namespace to only those endpoints in the same Echos.
	cfg := t.ConfigIstio().New()
	cfg.Eval(ns.Name(), map[string]any{
		"Namespaces": namespaces,
	}, `
apiVersion: networking.istio.io/v1alpha3
kind: Sidecar
metadata:
  name: restrict-to-namespace
spec:
  egress:
  - hosts:
    - "istio-system/*"
{{ range $ns := .Namespaces }}

      numTrustedProxies: 1 # Needed for X-Forwarded-For (See https://istio.io/latest/docs/ops/configuration/traffic-management/network-topologies/)
`
			}
		})).
		// Create namespaces first. This way, echo can correctly configure egress to all namespaces.
		SetupParallel(
			namespace.Setup(&echo1NS, namespace.Config{Prefix: "echo1", Inject: true}),
			namespace.Setup(&serverNS, namespace.Config{Prefix: "servers", Inject: true}),
		).
		SetupParallel(

			t.ConfigIstio().YAML(apps.Namespace.Name(), `apiVersion: networking.istio.io/v1alpha3
kind: Sidecar
metadata:
  name: allow-cross-namespaces
spec:
  workloadSelector:
    labels:
      app: a
  egress:
  - hosts:
    - "*/*"`).ApplyOrFail(t)
			// create an echo instance in each revisioned namespace, all these echo
			// instances will be injected with proxies from their respective versions

 -  -  -  - | -  -  -  -  -  -  -  -  -  -  -  -  -  -  |  -  -  -  -
            |                                           v
       +---------+                                  +--------+
   --->| ingress |                                  | egress |--->
       +---------+                                  +--------+
```

where the `[*]` represents a routing decision, and all of the boxes except in the top row