"pilot.ingress" "meshConfig.ingressService, meshConfig.ingressControllerMode, and meshConfig.ingressClass"
    "global.mtls.enabled" "the PeerAuthentication resource"
    "global.mtls.auto" "meshConfig.enableAutoMtls"
    "global.tracer.lightstep.address" "meshConfig.defaultConfig.tracing.lightstep.address"

kind: DestinationRule
metadata:
  name: db-mtls
spec:
  host: mydbserver.prod.svc.cluster.local
  trafficPolicy:
    tls:
      mode: MUTUAL
      clientCertificate: /etc/certs/myclientcert.pem
      privateKey: /etc/certs/client_private_key.pem
      caCertificates: /etc/certs/root.pem
    portLevelSettings:
      - port:
          number: 443
        tls:
          mode: SIMPLE

    For this to work, it must be configured as a `ClusterIP` Service with
    redirection enabled. This is colloquially referred to as a "gateway

spec:
  host: "multiversion"
  subsets:
  - name: "vistio"
    labels:
      version: "vistio"
    trafficPolicy:
      tls:
        mode: ISTIO_MUTUAL
  - name: "vlegacy"
    labels:
      version: "vlegacy"
    trafficPolicy:
      tls:
        mode: ISTIO_MUTUAL
  trafficPolicy:
    tls:

sasl             (on|off)    set to 'on' to enable SASL authentication
tls              (on|off)    set to 'on' to enable TLS
tls_skip_verify  (on|off)    trust server TLS without verification, defaults to "on" (verify)
client_tls_cert  (path)      path to client certificate for mTLS auth
client_tls_key   (path)      path to client key for mTLS auth

            ports:
            ## You can add custom gateway ports - google ILB default quota is 5 ports,
            - port: 15011
              name: grpc-pilot-mtls
            - port: 8060
              targetPort: 8060
              name: tcp-citadel-grpc-tls
            # Port 5353 is forwarded to kube-dns
            - port: 5353
              name: tcp-dns
          overlays:
            - kind: Deployment

spec:
  host: "multiversion"
  subsets:
  - name: "vistio"
    labels:
      version: "vistio"
    trafficPolicy:
      tls:
        mode: DISABLE
  - name: "vlegacy"
    labels:
      version: "vlegacy"
    trafficPolicy:
      tls:
        mode: DISABLE
  trafficPolicy:
    tls:

		t.Run("gRPC-svc-tls", func(t *testing.T) {
			// Replaces: insecure.NewCredentials
			creds, err := xdscreds.NewServerCredentials(xdscreds.ServerOptions{FallbackCreds: insecure.NewCredentials()})
			if err != nil {
				t.Fatal(err)
			}

			grpcOptions := []grpc.ServerOption{
				grpc.Creds(creds),
			}

			bootstrapB := GRPCBootstrap("echo-rbac-mtls", "test", "127.0.1.1", xdsPort)

				}
			}
		})
	}
}

func TestTLSFlags(t *testing.T) {
	testCases := []struct {
		desc string
		env  kubeAPIServeETCDEnv
		want []string
	}{
		{
			desc: "mTLS enabled",
			env: kubeAPIServeETCDEnv{
				CAKey:             "CAKey",
				CACert:            "CACert",
				CACertPath:        "CACertPath",
				APIServerKey:      "APIServerKey",

    app: istiod
    istio: pilot
    release: {{ .Release.Name }}
spec:
  ports:
    - port: 15010
      name: grpc-xds # plaintext
      protocol: TCP
    - port: 15012
      name: https-dns # mTLS with k8s-signed cert
      protocol: TCP
    - port: 443
      name: https-webhook # validation and injection
      targetPort: 15017
      protocol: TCP
    - port: 15014
      name: http-monitoring # prometheus stats