apiVersion: v1
data:
  cert: aHVzaCBodXNoIGh1c2gK
  key: c2VjcmV0IHNlY3JldAo=
kind: Secret
metadata:
  name: invalid-key
  namespace: istio-system
type: Opaque
---
apiVersion: networking.istio.io/v1
kind: Gateway
metadata:
  name: defaultgateway-invalid-keys
spec:
  selector:
    istio: ingressgateway # use istio default ingress gateway, so we expect the credential in istio-system
  servers:
    - port:
        number: 443
        name: https
        protocol: HTTPS
      tls:
        mode: SIMPLE
        credentialName: "invalid-key" # wrong key names, should have one error
      hosts:
        - "httpbin.example.com"
---
apiVersion: v1
data:
  tls.cert: aHVzaCBodXNoIGh1c2gK
kind: Secret
metadata:
  name: missing-key
  namespace: istio-system
type: kubernetes.io/tls
---
apiVersion: networking.istio.io/v1
kind: Gateway
metadata:
  name: defaultgateway-missing-keys
spec:
  selector:
    istio: ingressgateway # use istio default ingress gateway, so we expect the credential in istio-system
  servers:
    - port:
        number: 443
        name: https
        protocol: HTTPS
      tls:
        mode: SIMPLE
        credentialName: "missing-key" # missing keys, should have one error
      hosts:
        - "httpbin.example.com"
---
apiVersion: v1
data:
  tls.cert: aHVzaCBodXNoIGh1c2gK
  tls.key: c2VjcmV0IHNlY3JldAo=
kind: Secret
metadata:
  name: invalid-cert
  namespace: istio-system
type: kubernetes.io/tls
---
apiVersion: networking.istio.io/v1
kind: Gateway
metadata:
  name: defaultgateway-invalid-cert
spec:
  selector:
    istio: ingressgateway # use istio default ingress gateway, so we expect the credential in istio-system
  servers:
    - port:
        number: 443
        name: https
        protocol: HTTPS
      tls:
        mode: SIMPLE
        credentialName: "invalid-cert" # cert content is invalid, should have one error
      hosts:
        - "httpbin.example.com"
---
apiVersion: v1
data:
  tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUN5akNDQWJLZ0F3SUJBZ0lCQURBTkJna3Foa2lHOXcwQkFRc0ZBREFWTVJNd0VRWURWUVFLRXdwTGRXSmwKY201bGRHVnpNQjRYRFRJek1ETXhOREF5TlRRek1Gb1hEVEl6TURNeE5EQTJNVFUwTVZvd0ZURVRNQkVHQTFVRQpDaE1LUzNWaVpYSnVaWFJsY3pDQ0FTSXdEUVlKS29aSWh2Y05BUUVCQlFBRGdnRVBBRENDQVFvQ2dnRUJBTWZaClJaMzZhVW5tMlA1SEROUHFabExTVWpVL2Mxam9YUlVSNkJkMDVOWnhYT0lUNkNuY1pwRXhOUjhTc2l4Zis1WkMKbGxhSUtoSjhPQUVHc09LN3RhbTNDWUl3UjBpYlV4LytzTk9VR05hTHVmYkZVRXZNWVZQM3NoenpVMVpQWXhCQgpEVkZyaUR0bTQ5c3NQNmxFeUZuZ2FrbjQ5dzRuN05Fd0tQTExNa0hwUHpOQm81YkZBVDNGR1NUeHVlOW1KeE9SCms5QU1TVHRkaURhQ2pKRmZOUndsdzVDNkxFdXMwOVRrejlYL0ZzRFlXVlFVeEh2UjZCOGZ5WmtVVllIUFR4N3MKVWpjc1Q2azM4Z2RaVFZITHFCN2JOSTlrcnVkMFc4cDhCL1ZzVXpDcGZWMWw1WHdaZ1d4UUpSSW81ZWxZT2pFUgpQbnVPd0tnZDZXbW1YQ2xsQVNjQ0F3RUFBYU1sTUNNd0V3WURWUjBsQkF3d0NnWUlLd1lCQlFVSEF3RXdEQVlEClZSMFRBUUgvQkFJd0FEQU5CZ2txaGtpRzl3MEJBUXNGQUFPQ0FRRUFDSmZ2ZjhQUWxSeEpjUk1lUkltZE9EKy8KazZWZmN1SUIxcW5DN3UvY2FJbGxTdy9aMGQ4SWpJSkU1QXh2eXlaNENNdllYN0lLUjhCeGlYdm56NWw1KzhqNgpVeDBlWnE4WlNVNTVtN1JGUW0wd0cvS1B2Q0Rnb2I1MVl0WjBqeFZHbEVNRHMzUVoxUVVoTjhjaTU2akhjRE5HCko1VEVZMnBBSTFFcVRkVEZkT3hJWlRvQVFIZjhsOXJaVFJqOVc4YWdqREI2TUEwRDRYZGJid3JITmtPQW1IU3cKU2hzclNnbEgxa29QaVpLTkpuaUNsVXRUeU1tNUJPcVFJRmRvWU50NDh3enY5NGpERTlRVHNtcGx1NW9uelIvbwpxRkR2RUJKaWk1MWU3NElpYzl3U2RxSmtGUktjOENRbFkwakVVT3hLN05XREt1SHBpQXA0V3NNVjdSMlp2UT09Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0KCg==
  tls.key: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCk1JSUV2UUlCQURBTkJna3Foa2lHOXcwQkFRRUZBQVNDQktjd2dnU2pBZ0VBQW9JQkFRREc5MWNpYXBrTm1udW0KR1VFdEhwSVlrS0xkaW1ESlFRWlE5bGVJVkhwMzlxR2lwT0tvLzZLQnRmOGl2Z1BZZW04OFZKL2N0WkYzT0w0Qgp4ditocElBVTdPTkxRSGJEb1VKUGxTSkpJdE5zcC95UHE3SU40Y1BiYSsxWktmYWo2UFNZTHozM3ZjMktoZ1cxCnNxbXF4MGdsUUdrQVlEUjBzdmQreWFDaVEvaExqbWxjMjVFMWw3a2NZYklNRThnZG1LeTduQ1FCSnZIYjlLdWwKTXdHLzdyNWx3VTIwVHRBYStqeCt6aWREeEdFNFdhTERYWmtycWtsMUhwM3pvMUk2NXhQalNlMHhGbTlHQTlkRgpGazVuczhYbGxQOUNhcUlHb0lCeGxIbnlvMnRGWkJJeUVvOWdyeG1SdmdhL1kwd2QreTNibjBsa3JHTC9VVDh0CkhBRjdDWHpuQWdNQkFBRUNnZ0VBTU8rdXo3azJNY0ZZUGk4aDk2MzRNdkNJRGtNMXNPbzhXbmRzYWd5VkhxSmIKZVB4aS96djR4VHgxSng5akpNQmdVWTlpems4ZUd4dXFxQmRBMG9uNk1xdGM4Q3BIeTdBQzlqM3c4OW9MOUVLUQovT2syM3ZFelVlbUd0Qko5SmkxcTAyOXpKMWJZa2dTS3JQam5nQ2lKbHhmemUzTXVFN0hjNjZNOXpnczNxNlZJCmt5TVR3UDJqaHNrdXUveDRLUGg5Y3E4MHVEa0E1RW5yVlBTbUdoRmtrZW0zYWVlY3RIMGcxSUl6eEQrZzVtc0gKKzBEekdDUjVPMnRNelg0em5lMDBrTHFyZFF6ZXlUN2Ftc3dUeHJnOWh0TUgvR0FyU1kydVB1b3hiQVB1TElNUQozT0loNjJWd1B5TzE1NVBwVExEczBsdVpvMXZCREYvQk9pSnpISnZyT1FLQmdRRDhKZys3Y29wZWJmeHBnMXBJCmpNZVA1Mko2dDIvQW90K2xxcjB1VklpYVA0TDIxNmFHNHFSeS92L3BVeHp4RmFGN0hOckoxT051OFZmVHUxT3AKcnpTT29WZVNVdCs2d0NRRVJTVEVXTjA2U2crZm1EK0pFeEVPQjNud3hFMFJBNncrWVZ1ODNzUzM0Zy9uUk83RgoxbnBjclRrNjB3VzJsKzkyNytuaURTb0lOUUtCZ1FES0FWUFZVTzlFQnVUaXp0Y0JKNk1BT1JTbWJDTFNhMTM5Cm9HRG9sQ1RmV0IrNjBBZm1yL0cxMTk3Qk5tYW5TdXJnRVBmaXRxRjZRYUxNVGNSNzFnOGl4bTM1L2pYaHhNR2kKbU93OTFBTG1ScS9nYWFOSDd6V1BCaThNeG1LRDNEYVRJUk9YYXlLZi8yQkpBVDlpdmZKWk9JNXR2K3kwd1hPRApQL3J4K1cwc0t3S0JnQTJESEtTMjVxTlkwWVgxL0FpWFFycDdjOU9Qc1BWcHhRSmp1KytYcUJwYi9QQ3RiY2NjCnJpTmJkdXRTQU9NS2ZiVFRQd1pCMms0L3NLMHdCTE83SjkzYzE0eUgxR1YxbG5pRUhBeEpsdEZnMXFWK3l5alYKVkx5anVlMGxGOXdwampscGpqajQxeUhqZzJhcFV3SlhGQWVUWU5XK0tUZzN2Q1ZyaGVVUFA0bGhBb0dCQUwyQwpiMDZoWmthUW5TeDIxZGhjZ2h3VWNONE1kc0tuUFg5U2RYZmNlNWNZaW5QczlHeWtSWVBPYUVrbEt6cnBHdDVvCnJOV0JkbzVHZzE5ZDJlWS9sT1dQK043ZWNWaEVDVkRzWEQxSTZBdDI1MHNHYjh0dGkvYUkyNTBGaEtpbDhJRXAKTjhNSEhHMnozSFhBK09FK3g5eVNKWFNxNkh0UFBYbzFqTXh6cnNzUEFvR0FMOTVWL1d5cENPT0VnVWJsb0hQeApvK2NaNy95K2VScHpOK1d1VC9nTFZTMy9pamh5UFoyYlN3UVBiNnh1YlE0RVl0aVFIZWJud2ovVmxaTGphbFh6CnkyUWNiOUpHa0s3QTY1SnVUSjd3TGorTXBuZ1Awd3FGWEZyZlNuRUQzWDZPeGpmZGZsRm1HUW9MY251VUE0OUoKVG02QkE3R0ZOZVhoektBTlVzWlMzUDQ9Ci0tLS0tRU5EIFBSSVZBVEUgS0VZLS0tLS0K
kind: Secret
metadata:
  name: expired-secret
  namespace: istio-system
type: kubernetes.io/tls
---
apiVersion: networking.istio.io/v1
kind: Gateway
metadata:
  name: defaultgateway-expired
spec:
  selector:
    istio: ingressgateway # use istio default ingress gateway, so we expect the credential in istio-system
  servers:
    - port:
        number: 443
        name: https
        protocol: HTTPS
      tls:
        mode: SIMPLE
        credentialName: "expired-secret" # the cert is expired, should generate errors
      hosts:
        - "httpbin.example.com"
