apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  annotations:
    internal.istio.io/gateway-semantics: gateway
    internal.istio.io/gateway-service: eastwestgateway-istio.istio-system.svc.domain.suffix
    internal.istio.io/parents: Gateway/eastwestgateway/istiod-grpc.istio-system
  creationTimestamp: null
  name: eastwestgateway-istio-autogenerated-k8s-gateway-istiod-grpc
  namespace: istio-system
spec:
  servers:
  - hosts:

    reason: Accepted
    status: "True"
    type: Accepted
  - lastTransitionTime: fake
    message: Resource programmed, assigned to service(s) istio-ingressgateway.istio-system.svc.domain.suffix:34000
      and istio-ingressgateway.istio-system.svc.domain.suffix:34001
    reason: Programmed
    status: "True"
    type: Programmed
  listeners:
  - attachedRoutes: 1
    conditions:
    - lastTransitionTime: fake

	// Determine if the service is in the format we expect
	// (servicePorts are present and service type matches)
	formatCorrect := checkServiceFormat(svc, servicePorts, serviceType)
	if formatCorrect {
		return svc, false
	}
	svc.Spec.Ports = servicePorts
	svc.Spec.Type = serviceType
	return svc, true
}

// Determine if the service is in the correct format
// getMasterServiceUpdateIfNeeded expects (servicePorts are correct

apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  annotations:
    internal.istio.io/gateway-semantics: gateway
    internal.istio.io/gateway-service: istio-ingressgateway.istio-system.svc.domain.suffix
    internal.istio.io/parents: Gateway/gateway/apple.istio-system
  creationTimestamp: null
  name: gateway-istio-autogenerated-k8s-gateway-apple
  namespace: istio-system
spec:
  servers:
  - hosts:
    - apple/apple.example

        host: istiod.istio-system.svc.cluster.local
        port:
          number: 15012
  - match:
    - port: 15017
    route:
    - destination:
        host: istiod.istio-system.svc.cluster.local
        port:
          number: 443
---
apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
  name: istiod-dr
spec:
  host: istiod.istio-system.svc.cluster.local
  trafficPolicy:

	// nolint: lll
	ExpectedXfccHeader = `By=spiffe://cluster.local/ns/mounted-certs/sa/server;Hash=86948ccdaf2de73b20d389dc212aaf2d72f9f1ca239327cc2e8b05e61b1676d1;Subject="CN=client.mounted-certs.svc.cluster.local";URI=spiffe://cluster.local/ns/mounted-certs/sa/client;DNS=client.mounted-certs.svc`
)

func TestClientToServiceTls(t *testing.T) {
	framework.NewTest(t).
		Run(func(t framework.TestContext) {
			createObject(t, echo1NS.Name(), DestinationRuleConfigMutual)

		Hostname:        "hello.default.svc.cluster.local",
		Address:         "10.1.0.0",
		ServiceAccounts: []string{},
		ClusterID:       "cluster-1",
	})
	HelloInstanceV0 := MakeIP(HelloService, 0)

	if HelloInstanceV0 != "10.1.1.0" {
		t.Fatalf("MakeIP() can not handle ip4 address.")
	}

	HelloService1 := MakeService(ServiceArgs{
		Hostname:        "hello.default.svc.cluster.local",
		Address:         "asa",

	tests := []struct {
		in   string
		want bool
	}{
		{"kubernetes.default.svc", true},
		{"kubernetes.default.svc.cluster.local", true},
		{"https://kubernetes.default.svc", true},
		{"https://kubernetes.default.svc.cluster.local", true},
		{"foo.default.svc", false},
		{"foo.default.svc:80", false},
		{"https://foo.default.svc:80", false},
	}
	for _, tt := range tests {
		t.Run(tt.in, func(t *testing.T) {

	hcs.lock.Lock()
	defer hcs.lock.Unlock()

	// Remove any that are not needed any more.
	for nsn, svc := range hcs.services {
		if port, found := newServices[nsn]; !found || port != svc.port {
			klog.V(2).InfoS("Closing healthcheck", "service", nsn, "port", svc.port)

			// errors are loged in closeAll()
			_ = svc.closeAll()

			delete(hcs.services, nsn)

		}
	}

	// Add any that are needed.

  servers:
  - port:
      number: 80
      name: tcp-80
      protocol: TCP
    hosts:
    - external.{{ .externalNamespace }}.svc.cluster.local
  - port:
      number: 443
      name: tcp-443
      protocol: TCP
    hosts: