# istio_eastwest-tlsoption.yaml
apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
  name: eastwestgateway
  namespace: istio-system
  labels:
    topology.istio.io/network: "network-1"
spec:
  gatewayClassName: istio
  listeners:
  - name: istiod-grpc
    port: 15012
    protocol: TLS
    tls:
      mode: Passthrough
  - name: istiod-webhook
    port: 15017
    protocol: TLS
    tls:
      mode: Passthrough
  - name: cross-network
    hostname: "*.local"
    port: 35443
    protocol: TLS
    tls:
      mode: Passthrough
      options:
        gateway.istio.io/listener-protocol: auto-passthrough
---
apiVersion: gateway.networking.k8s.io/v1
kind: TLSRoute
metadata:
  name: eastwestgateway-grpc
  namespace: istio-system
spec:
  parentRefs:
  - name: eastwestgateway
    kind: Gateway
    sectionName: istiod-grpc
  hostnames:
  - "*.example.com"
  rules:
  - backendRefs:
    - name: istiod
      port: 15012
---
apiVersion: gateway.networking.k8s.io/v1
kind: TLSRoute
metadata:
  name: eastwestgateway-webhook
  namespace: istio-system
spec:
  parentRefs:
  - name: eastwestgateway
    kind: Gateway
    sectionName: istiod-webhook
  hostnames:
  - "*.example.com"
  rules:
  - backendRefs:
    - name: istiod
      port: 15017