subset: v1
      weight: 70
    - destination:
        host: http1.ns1.svc.cluster.local
        subset: v2
      weight: 30
---
apiVersion: networking.istio.io/v1alpha3
kind: ServiceEntry
metadata:
  name: http1
  namespace: ns2
spec:
  hosts:
  - http1.ns2.svc.cluster.local
  addresses:
  - 3.1.1.1
  ports:
  - number: 8080
    name: http

    name: echo
---
apiVersion: gateway.networking.k8s.io/v1alpha2
kind: TCPRoute
metadata:
  name: allowed-my-svc
  namespace: istio-system
spec:
  parentRefs:
  - name: gateway
    namespace: istio-system
    sectionName: my-svc
  rules:
  - backendRefs:
    - name: my-svc
      namespace: service
      port: 34000
---
apiVersion: gateway.networking.k8s.io/v1alpha2
kind: TCPRoute
metadata:

      - "istiod-{{.Revision}}.istio-system.svc"
      - "istiod-{{.Revision}}.istio-system.svc.cluster.local"
    route:
    - destination:
        host: istiod-{{.Revision}}.istio-system.svc.cluster.local
        port:
          number: 15012
  - match:
    - port: 15017
      sniHosts:
      - "istiod-{{.Revision}}.istio-system.svc"
      - "istiod-{{.Revision}}.istio-system.svc.cluster.local"
    route:
    - destination:

		annotations[v1.AnnotationLoadBalancerSourceRangesKey] = v
		svc := v1.Service{}
		svc.Annotations = annotations
		_, err := GetLoadBalancerSourceRanges(&svc)
		if err == nil {
			t.Errorf("Expected error parsing: %q", v)
		}
		svc = v1.Service{}
		svc.Spec.LoadBalancerSourceRanges = strings.Split(v, ",")
		_, err = GetLoadBalancerSourceRanges(&svc)
		if err == nil {
			t.Errorf("Expected error parsing: %q", v)
		}
	}

  rules:
  - to:
    - operation:
        hosts:
{{- range $svc := .Services }}
        - "example.{{ $svc.ServiceName }}.com"
{{- end }}
    from:
    - source:
        requestPrincipals: ["******@****.***/sub-1"]
  - to:
    - operation:
        hosts:
  {{- range $svc := .Services }}
        - "any-request-principal-ok.{{ $svc.ServiceName }}.com"
  {{- end }}
    from:
    - source:

	if svc == nil {
		// Default policy when the service doesn't exist.
		return model.DiscoverableFromSameCluster
	}

	if strings.HasSuffix(svc.Hostname.String(), "."+constants.DefaultClusterSetLocalDomain) {
		return ec.clusterSetLocalPolicySelector(svc)
	}

	return ec.clusterLocalPolicySelector(svc)
}

func (svc *VirtualServer) Equal(other *VirtualServer) bool {
	return svc.Address.Equal(other.Address) &&
		svc.Protocol == other.Protocol &&
		svc.Port == other.Port &&
		svc.Scheduler == other.Scheduler &&
		svc.Flags == other.Flags &&
		svc.Timeout == other.Timeout
}

func (svc *VirtualServer) String() string {

  hosts:
  - third.domain.example
  http:
  - name: default.invalid-backendRef-mixed.0
    route:
    - destination:
        host: nonexistent.default.svc.domain.suffix
        port:
          number: 80
      weight: 1
    - destination:
        host: httpbin.default.svc.domain.suffix
        port:
          number: 80
      weight: 1
    - destination: {}
      weight: 1
---

kind: DestinationRule
metadata:
  name: originate-tls-for-external-svc
spec:
  host: {{ .EgressGatewayServiceName | default "istio-egressgateway" }}.{{ .EgressGatewayServiceNamespace | default "istio-system" }}.svc.cluster.local
  subsets:
  - name: originate-tls-for-plain-traffic
    trafficPolicy:
      tls:
        mode: SIMPLE
        sni: external.{{ .externalNamespace }}.svc.cluster.local

  # Policy: {{ $policy.name }}
  policy_{{ $idx }}.json: |-
    {{- include (print $.Template.BasePath "/_helper_policy.tpl") . | nindent 4 }}
  {{ end }}
  {{- range $idx, $svc := .Values.svcaccts }}
  {{- if $svc.policy }}
  # SVC: {{ $svc.accessKey }}
  svc_policy_{{ $idx }}.json: |-
    {{- include (print $.Template.BasePath "/_helper_policy.tpl") .policy | nindent 4 }}
  {{- end }}
  {{- end }}
  add-svcacct: |-