name: workload-certs
        - mountPath: /var/run/secrets/istio
          name: istiod-ca-cert
        - mountPath: /var/lib/istio/data
          name: istio-data
        - mountPath: /etc/istio/proxy
          name: istio-envoy
        - mountPath: /var/run/secrets/tokens
          name: istio-token
        - mountPath: /etc/istio/pod
          name: istio-podinfo
      initContainers:
      - args:

          name: workload-certs
        - mountPath: /var/run/secrets/istio
          name: istiod-ca-cert
        - mountPath: /var/lib/istio/data
          name: istio-data
        - mountPath: /etc/istio/proxy
          name: istio-envoy
        - mountPath: /var/run/secrets/tokens
          name: istio-token
        - mountPath: /etc/istio/pod
          name: istio-podinfo
      initContainers:
      - args:

# securityNotes is a markdown listing of any changes related to the security of
# Istio.
securityNotes:
  - |
    __Source principal validation at Gateway does not work even with ISTIO_MUTUAL TLS mode__:

package trustbundle

import (
	"crypto/x509"
	"encoding/pem"
	"fmt"
	"sort"
	"strings"
	"sync"
	"time"

	meshconfig "istio.io/api/mesh/v1alpha1"
	"istio.io/istio/pkg/config/mesh"
	"istio.io/istio/pkg/log"
	"istio.io/istio/pkg/slices"
	"istio.io/istio/pkg/spiffe"
	"istio.io/istio/pkg/util/sets"
)

// Source is all possible sources of MeshConfig
type Source int

const (
	SourceIstioCA Source = iota

kind: Gateway
metadata:
  name: eastwestgateway
  namespace: istio-system
  labels:
    topology.istio.io/network: "network-1"
    networking.istio.io/gatewayPort: 35443
spec:
  gatewayClassName: istio
  listeners:
  - name: istiod-grpc
    port: 15012
    protocol: TLS
    tls:
      mode: Passthrough
  - name: istiod-webhook
    port: 15017
    protocol: TLS
    tls:
      mode: Passthrough

apiVersion: gateway.networking.k8s.io/v1beta1
kind: Gateway
metadata:
  name: eastwestgateway
  namespace: istio-system
  labels:
    topology.istio.io/network: "network-1"
spec:
  gatewayClassName: istio
  listeners:
  - name: istiod-grpc
    port: 15012
    protocol: TLS
    tls:
      mode: Passthrough
  - name: istiod-webhook
    port: 15017
    protocol: TLS
    tls:
      mode: Passthrough
  - name: cross-network

kind: ValidatingWebhookConfiguration
metadata:
  name: istiod-default-validator
  labels:
    app: istiod
    istio: istiod
    istio.io/rev: {{ .Values.revision | default "default" | quote }}
    istio.io/tag: "default"
    # Required to make sure this resource is removed
    # when purging Istio resources
    operator.istio.io/component: Pilot
webhooks:
  - name: validation.istio.io
    clientConfig:

Pengyuan Bian <******@****.***> 1625172474 -0700

10.244.0.176:15021                               HEALTHY                  outbound|15021||istio-ingressgateway.istio-system.svc.cluster.local
10.244.0.175:15017                               HEALTHY                  outbound|443||istiod.istio-system.svc.cluster.local
10.244.0.175:15010                               HEALTHY                  outbound|15010||istiod.istio-system.svc.cluster.local

        sidecar.istio.io/proxyCPU: 4000m
        sidecar.istio.io/status: '{"initContainers":["istio-init"],"containers":["istio-proxy"],"volumes":["workload-socket","credential-socket","workload-certs","istio-envoy","istio-data","istio-podinfo","istio-token","istiod-ca-cert"],"imagePullSecrets":null,"revision":"default"}'
        traffic.sidecar.istio.io/excludeInboundPorts: 4,5,6