# istio_reference-policy-tls.yaml
apiVersion: gateway.networking.k8s.io/v1
kind: GatewayClass
metadata:
  name: istio
spec:
  controllerName: istio.io/gateway-controller
---
apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
  name: gateway
  namespace: istio-system
spec:
  addresses:
  - value: istio-ingressgateway
    type: Hostname
  gatewayClassName: istio
  tls:
    frontend:
      default:
        validation:
          caCertificateRefs:
            - group: ""
              kind: ConfigMap
              namespace: default
              name: auth-cert
  listeners:
  - name: cross
    hostname: "cert1.domain.example"
    port: 443
    protocol: HTTPS
    allowedRoutes:
      namespaces:
        from: Selector
        selector:
          matchLabels:
            kubernetes.io/metadata.name: "cert"
    tls:
      mode: Terminate
      certificateRefs:
      - name: cert
        namespace: cert
---
apiVersion: gateway.networking.k8s.io/v1beta1
kind: ReferenceGrant
metadata:
  name: allow-cert
  namespace: cert
spec:
  from:
  - group: gateway.networking.k8s.io
    kind: Gateway
    namespace: istio-system
  to:
    - group: ""
      kind: Secret
---
apiVersion: gateway.networking.k8s.io/v1beta1
kind: ReferenceGrant
metadata:
  name: allow-cacert
  namespace: default
spec:
  from:
  - group: gateway.networking.k8s.io
    kind: Gateway
    namespace: istio-system
  to:
  - group: ""
    kind: ConfigMap
---
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: http
  namespace: cert
spec:
  parentRefs:
  - name: gateway
    namespace: istio-system
  hostnames: ["cert1.domain.example"]
  rules:
  - backendRefs:
    - name: httpbin
      port: 80