apiVersion: v1
data:
  tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUN6RENDQWJTZ0F3SUJBZ0lCQURBTkJna3Foa2lHOXcwQkFRc0ZBREFWTVJNd0VRWURWUVFLRXdwTGRXSmwKY201bGRHVnpNQ0FYRFRJek1ETXhOREF5TlRRek1Gb1lEekl4TWpJd01qRTRNRFl4T0RNMldqQVZNUk13RVFZRApWUVFLRXdwTGRXSmxjbTVsZEdWek1JSUJJakFOQmdrcWhraUc5dzBCQVFFRkFBT0NBUThBTUlJQkNnS0NBUUVBCndLUUJ6bzJWNW4vZVk2M2NHdUZFUGM3M0ZNOVdlR0lMOTd6Z2ZkeTNWak13SW1xbnFxcTIxWjBoOTlIR1hJdkMKRG1qSzhKS2RHRVExeUhwN0l3QXVZUVZPUnJON3dGUDJiR1hoNXdoY3pCVWlCeG5reis2WTc2ZEw5d2JhSGVrRQp2dmdJbHVwZWg4Sjlmb29uQUk5ZG9NeGhiSGkvWEwxenZreDRaaGJtMEZBdXg5QS9qNjg3a1V2b09DbFFZNUhKCkRkYXlKVzlzUmZscHFqcFhhMmxzVzNnUXlBZVlkbzBtY2dPUXdOUytiSnExTjNwNUZHSnh1Z1BZVVNvUVA1SUQKcitVN1B0dUpMalBIaUJmbGxpdDMvdjJ3UGRkWjlkYmlJN0U5L2ZwcGF0MWFFZlBYaVNCaGwwV3g5OXZlQVl6MQpVQUN3eHJaakRvb2lhZ3JFNmJXZTh3SURBUUFCb3lVd0l6QVRCZ05WSFNVRUREQUtCZ2dyQmdFRkJRY0RBVEFNCkJnTlZIUk1CQWY4RUFqQUFNQTBHQ1NxR1NJYjNEUUVCQ3dVQUE0SUJBUUFUUW9najFwU1NZeXVmbkZQVytZMVAKYmNmWVpVNVZCL29JVWxaODEwd0NkSFRtdlRQVENWQkdLSm5xVjZTM0w1WDBiNVRWL2FiL3k4eVFHc01FcG1rVQpOa0Jab0E4SDREVW00cldZNEt3NlRCL0xsTmxwV080T0w3MU1yRUxsK29XRkZjYUp0QmNISDBmYzJsQVczMVYrCjlhNjNpWDBhQm9icXZqdDlQcGVwM0JVTFdwWGJjNDIvN2xjQkN2UVkvN0dvc1AydVRybHJpWkR5ek9KZkNQRWUKYUpPYjZ0aHdkY3ZYM1V3SnozQ3pQbVVKQ3pqQXN5MzljVnJzRDZPbExkNk1jN0ZObVBoN1pROUs1U0p6U09MRgpncUN1SDZxbUJKSVVRR3VXYmZEVXloOTlQZUZSSEhYSTAzZENHS1RBOVdwM1hESkxYN0VVdWRlZGtDYlJoYTVPCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0KCg==
  tls.key: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCk1JSUV2UUlCQURBTkJna3Foa2lHOXcwQkFRRUZBQVNDQktjd2dnU2pBZ0VBQW9JQkFRREc5MWNpYXBrTm1udW0KR1VFdEhwSVlrS0xkaW1ESlFRWlE5bGVJVkhwMzlxR2lwT0tvLzZLQnRmOGl2Z1BZZW04OFZKL2N0WkYzT0w0Qgp4ditocElBVTdPTkxRSGJEb1VKUGxTSkpJdE5zcC95UHE3SU40Y1BiYSsxWktmYWo2UFNZTHozM3ZjMktoZ1cxCnNxbXF4MGdsUUdrQVlEUjBzdmQreWFDaVEvaExqbWxjMjVFMWw3a2NZYklNRThnZG1LeTduQ1FCSnZIYjlLdWwKTXdHLzdyNWx3VTIwVHRBYStqeCt6aWREeEdFNFdhTERYWmtycWtsMUhwM3pvMUk2NXhQalNlMHhGbTlHQTlkRgpGazVuczhYbGxQOUNhcUlHb0lCeGxIbnlvMnRGWkJJeUVvOWdyeG1SdmdhL1kwd2QreTNibjBsa3JHTC9VVDh0CkhBRjdDWHpuQWdNQkFBRUNnZ0VBTU8rdXo3azJNY0ZZUGk4aDk2MzRNdkNJRGtNMXNPbzhXbmRzYWd5VkhxSmIKZVB4aS96djR4VHgxSng5akpNQmdVWTlpems4ZUd4dXFxQmRBMG9uNk1xdGM4Q3BIeTdBQzlqM3c4OW9MOUVLUQovT2syM3ZFelVlbUd0Qko5SmkxcTAyOXpKMWJZa2dTS3JQam5nQ2lKbHhmemUzTXVFN0hjNjZNOXpnczNxNlZJCmt5TVR3UDJqaHNrdXUveDRLUGg5Y3E4MHVEa0E1RW5yVlBTbUdoRmtrZW0zYWVlY3RIMGcxSUl6eEQrZzVtc0gKKzBEekdDUjVPMnRNelg0em5lMDBrTHFyZFF6ZXlUN2Ftc3dUeHJnOWh0TUgvR0FyU1kydVB1b3hiQVB1TElNUQozT0loNjJWd1B5TzE1NVBwVExEczBsdVpvMXZCREYvQk9pSnpISnZyT1FLQmdRRDhKZys3Y29wZWJmeHBnMXBJCmpNZVA1Mko2dDIvQW90K2xxcjB1VklpYVA0TDIxNmFHNHFSeS92L3BVeHp4RmFGN0hOckoxT051OFZmVHUxT3AKcnpTT29WZVNVdCs2d0NRRVJTVEVXTjA2U2crZm1EK0pFeEVPQjNud3hFMFJBNncrWVZ1ODNzUzM0Zy9uUk83RgoxbnBjclRrNjB3VzJsKzkyNytuaURTb0lOUUtCZ1FES0FWUFZVTzlFQnVUaXp0Y0JKNk1BT1JTbWJDTFNhMTM5Cm9HRG9sQ1RmV0IrNjBBZm1yL0cxMTk3Qk5tYW5TdXJnRVBmaXRxRjZRYUxNVGNSNzFnOGl4bTM1L2pYaHhNR2kKbU93OTFBTG1ScS9nYWFOSDd6V1BCaThNeG1LRDNEYVRJUk9YYXlLZi8yQkpBVDlpdmZKWk9JNXR2K3kwd1hPRApQL3J4K1cwc0t3S0JnQTJESEtTMjVxTlkwWVgxL0FpWFFycDdjOU9Qc1BWcHhRSmp1KytYcUJwYi9QQ3RiY2NjCnJpTmJkdXRTQU9NS2ZiVFRQd1pCMms0L3NLMHdCTE83SjkzYzE0eUgxR1YxbG5pRUhBeEpsdEZnMXFWK3l5alYKVkx5anVlMGxGOXdwampscGpqajQxeUhqZzJhcFV3SlhGQWVUWU5XK0tUZzN2Q1ZyaGVVUFA0bGhBb0dCQUwyQwpiMDZoWmthUW5TeDIxZGhjZ2h3VWNONE1kc0tuUFg5U2RYZmNlNWNZaW5QczlHeWtSWVBPYUVrbEt6cnBHdDVvCnJOV0JkbzVHZzE5ZDJlWS9sT1dQK043ZWNWaEVDVkRzWEQxSTZBdDI1MHNHYjh0dGkvYUkyNTBGaEtpbDhJRXAKTjhNSEhHMnozSFhBK09FK3g5eVNKWFNxNkh0UFBYbzFqTXh6cnNzUEFvR0FMOTVWL1d5cENPT0VnVWJsb0hQeApvK2NaNy95K2VScHpOK1d1VC9nTFZTMy9pamh5UFoyYlN3UVBiNnh1YlE0RVl0aVFIZWJud2ovVmxaTGphbFh6CnkyUWNiOUpHa0s3QTY1SnVUSjd3TGorTXBuZ1Awd3FGWEZyZlNuRUQzWDZPeGpmZGZsRm1HUW9MY251VUE0OUoKVG02QkE3R0ZOZVhoektBTlVzWlMzUDQ9Ci0tLS0tRU5EIFBSSVZBVEUgS0VZLS0tLS0K
kind: Secret
metadata:
  name: httpbin-credential
  namespace: istio-system
type: Opaque
---
apiVersion: v1
kind: Pod
metadata:
  labels:
    myapp: custom-gateway
  name: custom-gateway
---
apiVersion: networking.istio.io/v1
kind: Gateway
metadata:
  name: defaultgateway-noerrors
spec:
  selector:
    istio: ingressgateway # use istio default ingress gateway, so we expect the credential in istio-system
  servers:
  - port:
      number: 443
      name: https
      protocol: HTTPS
    tls:
      mode: SIMPLE
      credentialName: "httpbin-credential" # Correct credential, should not produce an error message
    hosts:
    - "httpbin.example.com"
---
apiVersion: networking.istio.io/v1
kind: Gateway
metadata:
  name: defaultgateway-bogusCredentialName
spec:
  selector:
    istio: ingressgateway # use istio default ingress gateway, so we expect the credential in istio-system
  servers:
  - port:
      number: 443
      name: https
      protocol: HTTPS
    tls:
      mode: SIMPLE
      credentialName: "httpbin-credential-bogus" # Should break, wrong credential name
    hosts:
    - "httpbin.example.com"
---
apiVersion: networking.istio.io/v1
kind: Gateway
metadata:
  name: customgateway-wrongnamespace
spec:
  selector:
    istio: custom-gateway # Custom gateway
  servers:
  - port:
      number: 443
      name: https
      protocol: HTTPS
    tls:
      mode: SIMPLE
      credentialName: "httpbin-credential" # Should break, doesn't exist in custom-gateway's namespace
    hosts:
    - "httpbin.example.com"
---
apiVersion: networking.istio.io/v1
kind: Gateway
metadata:
  name: bogusgateway
spec:
  selector:
    istio: custom-gateway # Nothing matches this, should generate an error
  servers:
  - port:
      number: 443
      name: https
      protocol: HTTPS
    tls:
      mode: SIMPLE
      credentialName: "httpbin-credential"
    hosts:
    - "httpbin.example.com"
---
apiVersion: networking.istio.io/v1
kind: Gateway
metadata:
  name: defaultgateway-nocredential # No credentialName specified, we shouldn't generate any errors
spec:
  selector:
    istio: ingressgateway
  servers:
  - port:
      number: 443
      name: https
      protocol: HTTPS
    tls:
      mode: SIMPLE
    hosts:
    - "httpbin.example.com"