Steven Landow <******@****.***> 1689628792 -0700

Frank Budinsky <******@****.***> 1699583427 -0500

Frank Budinsky <******@****.***> 1699583427 -0500

Steven Landow <******@****.***> 1689628792 -0700

        # the target port is needed to avoid the DENY policy also applying to
        # traffic through the eastwest-gateway. Since all eastwest-gateway
        # traffic is TCP, the policy will attempt to be as restrictive as
        # possible and block all traffic through the eastwest-gateway.
        ports: [ "18080", "18085" ]
        paths: ["/global-deny*"]
        notPaths: ["/global-deny/allow"]

spec:
  host: "*"
  trafficPolicy:
    tls:
      mode: {{ .TLSMode }}
---
# Apply a local policy to the system namespace to turn this off
# Otherwise, the eastwest gateway will be impacted
apiVersion: networking.istio.io/v1beta1
kind: DestinationRule
metadata:
  name: "eastwest-opt-out"
spec:
  exportTo: [.]
  host: "*"
  trafficPolicy:
    loadBalancer:

  host: "*"
  trafficPolicy:
    loadBalancer:
      simple: PASSTHROUGH
---
# Apply a local policy to the system namespace to turn this off
# Otherwise, the eastwest gateway will be impacted
apiVersion: networking.istio.io/v1beta1
kind: DestinationRule
metadata:
  name: "eastwest-opt-out"
  annotations:
    test-suite: "beta-mtls-on"
spec:
  exportTo: [.]
  host: "*"
  trafficPolicy:
    loadBalancer:

       This documentation will guide you through running a dedicate gateway deployment for this type of traffic (generally referred to as the `eastwest-gateway`).
       This `eastwest-gateway` will automatically be configured to support `AUTO_PASSTHROUGH`.

Run the following command to deploy the east-west gateway to a primary cluster:

```bash
export MESH=mesh1
export CLUSTER=cluster1
export NETWORK=network1
./samples/multicluster/gen-eastwest-gateway.sh | \
    istioctl manifest generate -f - | \
    kubectl apply -f -
```

The `CLUSTER` and `NETWORK` environment variables should match the values used to deploy the control plane
in that cluster.

		Setup(func(t resource.Context) error {
			t.Settings().Ambient = true
			return nil
		}).
		Setup(istio.Setup(&i, func(ctx resource.Context, cfg *istio.Config) {
			// can't deploy VMs without eastwest gateway
			ctx.Settings().SkipVMs()
			cfg.DeployEastWestGW = false
			cfg.ControlPlaneValues = `
components:
  cni:
    namespace: "kube-system"
values:
  pilot:
    taint:
      enabled: true