apiVersion: v1
kind: ServiceAccount
metadata:
  name: testapp-api
  namespace: default
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: testapp-api
  labels:
    app: testapp-api
    version: v1
spec:
  replicas: 1
  selector:
    matchLabels:
      app: testapp-api
      version: v1
  template:
    metadata:
      labels:
        app: testapp-api
        version: v1
    spec:
      serviceAccountName: testapp-api
      containers:
      - name: testapp-api
        image: 127.0.0.1:5000/testapp/api:v1
        resources:
          limits:
            cpu: 100m
            memory: 128Mi
          requests:
            cpu: 100m
            memory: 64Mi
        imagePullPolicy: Always
        ports:
        - containerPort: 8080
---
apiVersion: v1
kind: Service
metadata:
  name: testapp-api
  labels:
    app: testapp-api
spec:
  ports:
  - port: 8080
    name: http
  selector:
    app: testapp-api
---
apiVersion: networking.istio.io/v1alpha3
kind: ServiceEntry
metadata:
  name: httpbin
spec:
  hosts:
  - httpbin.org
  ports:
  - number: 80
    name: http-port
    protocol: HTTP
  resolution: DNS
  location: MESH_EXTERNAL
---
apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: httpbin
spec:
  selector:
    istio: egressgateway
  servers:
  - port:
      number: 80
      name: https
      protocol: HTTPS
    hosts:
    - httpbin.org
    tls:
      mode: MUTUAL
      serverCertificate: /etc/certs/cert-chain.pem
      privateKey: /etc/certs/key.pem
      caCertificates: /etc/certs/root-cert.pem
---
apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
  name: httpbin
spec:
  host: istio-egressgateway.istio-system.svc.cluster.local
  subsets:
  - name: httpbin
    trafficPolicy:
      loadBalancer:
        simple: ROUND_ROBIN
      portLevelSettings:
      - port:
          number: 80
        tls:
          mode: ISTIO_MUTUAL
          sni: httpbin.org
#  trafficPolicy:
#    tls:
#      mode: ISTIO_MUTUAL
---
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: httpbin
spec:
  hosts:
  - httpbin.org
  gateways:
  - httpbin
  - mesh
  http:
  - match:
    - gateways:
      - mesh
      port: 80
    route:
    - destination:
        host: istio-egressgateway.istio-system.svc.cluster.local
        subset: httpbin
        port:
          number: 80
      weight: 100
  - match:
    - gateways:
      - httpbin
      port: 80
    route:
    - destination:
        host: httpbin.org
        port:
          number: 80
      weight: 100