apiVersion: gateway.networking.k8s.io/v1beta1
kind: Gateway
metadata:
  name: gateway
  namespace: istio-system
spec:
  addresses:
  - value: istio-ingressgateway
    type: Hostname
  gatewayClassName: istio
  listeners:
  - name: default
    port: 34000
    protocol: TCP
    allowedRoutes:
      namespaces:
        from: All
---
apiVersion: gateway.networking.k8s.io/v1alpha2
kind: TCPRoute
metadata:
  name: tcp

 * Allows the registration of {@link WorkInputListener work input listeners}.
 */
@ServiceScope(Global.class)
public interface WorkInputListeners {
    /**
     * Registers the listener with the build, the listener can be unregistered with {@link #removeListener(WorkInputListener)}.
     */
    void addListener(WorkInputListener listener);

    void removeListener(WorkInputListener listener);

	// Test cases:
	// 1. http case:
	//    client -------> Hits listener 0.0.0.0_80 cluster
	//    Metric is istio_requests_total i.e. HTTP
	//
	// 2. https case:
	//    client ----> Hits no listener -> 0.0.0.0_150001 -> ALLOW_ANY/REGISTRY_ONLY
	//    Metric is istio_tcp_connections_closed_total i.e. TCP
	//
	// 3. https conflict case:
	//    client ----> Hits listener 0.0.0.0_9443

kind: bug-fix
area: traffic-management
issue:
- 28269
releaseNotes:
- |
  **Fixed** when a node has multiple IP addresses (e.g., a VM in the mesh expansion scenario),
  Istio Proxy will now bind `inbound` listeners to the first applicable address in the list

apiVersion: gateway.networking.k8s.io/v1beta1
kind: Gateway
metadata:
  name: helloworld-gateway
spec:
  gatewayClassName: istio
  listeners:
  - name: http
    port: 80
    protocol: HTTP
    allowedRoutes:
      namespaces:
        from: Same
---
apiVersion: gateway.networking.k8s.io/v1beta1
kind: HTTPRoute
metadata:
  name: helloworld
spec:
  parentRefs:
  - name: helloworld-gateway
  rules:
  - matches:

  - value: "1.a.3.4"
  - value: "foo.com"
  - type: IPAddress
    value: "256.255.255.255"
  - type: "Hostname"
    value: "foo.com:80"
  - type: "example.com/custom"
    value: "anything goes"
  listeners:
  - protocol: HTTP
    port: 80
    name: prod-web-gw
    allowedRoutes:
      namespaces:

apiVersion: gateway.networking.k8s.io/v1beta1
kind: Gateway
metadata:
  name: {{ .To.ServiceName }}-gateway
spec:
  gatewayClassName: istio
  listeners:
  - name: http
    # Exposing port 80 isn't the recommended security practice 
    port: 80
    protocol: HTTP
    hostname: "*.{{ .To.ServiceName }}.com"
---
apiVersion: gateway.networking.k8s.io/v1beta1
kind: HTTPRoute
metadata:
  name: {{ .To.ServiceName }}
spec:

  addresses:
  - type: Hostname
    value: istio-ingressgateway
  - type: Hostname
    value: istio-ingressgateway.not-default.svc.domain.suffix
  - type: Hostname
    value: example.com
  listeners:
  - name: http
    hostname: "*.domain.example"
    port: 80
    protocol: HTTP
  - name: tcp
    port: 34000
    protocol: TCP
    allowedRoutes:
      namespaces:

apiVersion: gateway.networking.k8s.io/v1beta1
kind: Gateway
metadata:
  name: gateway
  namespace: istio-system
spec:
  addresses:
  - value: istio-ingressgateway
    type: Hostname
  gatewayClassName: istio
  listeners:
  - name: default
    port: 34000
    protocol: TCP
---
apiVersion: gateway.networking.k8s.io/v1alpha2
kind: TCPRoute
metadata:
  name: tcp
  namespace: istio-system
spec:
  parentRefs:

    RecordingListener listener = new RecordingListener();
    manager.addListener(listener, directExecutor());
    manager.startAsync().awaitHealthy();
    assertTrue(manager.isHealthy());
    assertTrue(listener.healthyCalled);
    assertFalse(listener.stoppedCalled);
    assertTrue(listener.failedServices.isEmpty());
    manager.stopAsync().awaitStopped();