namespace: istio-system
spec:
  gateways:
  - istio-system/eastwestgateway-istio-autogenerated-k8s-gateway-istiod-grpc
  hosts:
  - '*'
  tls:
  - match:
    - sniHosts:
      - '*'
    route:
    - destination:
        host: istiod.istio-system.svc.domain.suffix
        port:
          number: 15012
---
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService

  tls:
  - match:
    - port: 443
      sniHosts:
      - api.dropboxapi.com
    route:
    - destination:
        host: api.dropboxapi.com
  - match:
    - port: 443
      sniHosts:
      - www.googleapis.com
    route:
    - destination:
        host: www.googleapis.com
  - match:
    - port: 443
      sniHosts:
      - api.facebook.com
    route:
    - destination:

metadata:
  name: direct-cnn-through-egress-gateway
spec:
  hosts:
  - fake.external.com
  gateways:
  - istio-egressgateway
  - mesh
  tls:
  - match:
    - gateways:
      - mesh
      port: 443
      sniHosts:
      - fake.external.com
    route:
    - destination:
        host: istio-egressgateway.istio-system.svc.cluster.local
        port:
          number: 443
      weight: 100
  tcp:
  - match:

  namespace: default
spec:
  gateways:
  - istio-system/gateway-istio-autogenerated-k8s-gateway-passthrough
  hosts:
  - foo.com
  tls:
  - match:
    - sniHosts:
      - foo.com
    route:
    - destination:
        host: httpbin-foo.default.svc.domain.suffix
        port:
          number: 443
---
apiVersion: networking.istio.io/v1alpha3

  creationTimestamp: null
  name: egress-tls-0-istio-autogenerated-k8s-gateway
  namespace: default
spec:
  gateways:
  - mesh
  hosts:
  - google.com
  tls:
  - match:
    - sniHosts:
      - google.com
    route:
    - destination:
        host: google.com
        port:
          number: 443
---
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:

"namespace"
"request"
"response"
"route"
"uri"
"method"
"authority"
"sourceLabels"
"queryParams"
"ignoreUriCase"
"withoutHeaders"
"sourceNamespace"
"destination"
"destinationSubnets"
"sniHosts"
"redirectCode"
"retryRemoteLocalities"
"retryOn"
"perTryTimeout"
"attempts"
"allowOrigins"
"allowMethods"
"allowHeaders"
"exposeHeaders"
"maxAge"
"allowCredentials"
"abort"
"set"

        port:
          number: 80
  tls:
  - match:
    - port: {{ .externalSvcTlsPort }}
      sniHosts:
      - external.{{ .externalNamespace }}.svc.cluster.local
    route:
    - destination:

        port:
          number: 80
  tls:
  - match:
    - port: {{ .externalSvcTlsPort }}
      sniHosts:
      - external.{{ .externalNamespace }}.svc.cluster.local
    route:
    - destination:

  namespace: none
spec:
  hosts:
  - www1.googleapis.com
  - api1.facebook.com
  tls:
  - match:
    - port: 2443
      sniHosts:
      - www1.googleapis.com
    route:
    - destination:
        host: www1.googleapis.com
  - match:
    - port: 2443
      sniHosts:
      - api1.facebook.com
    route:
    - destination:
        host: api1.facebook.com
---

    protocol: TCP
---
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: vs1
spec:
  hosts:
  - blah.somedomain
  tls:
  - match:
    - port: 9999
      sniHosts:
      - blah.somedomain
    route:
    - destination:
        host: blah.somedomain
        port:
          number: 9999`

func TestServiceEntry(t *testing.T) {
	cases := []simulationTest{
		{