# T91 wiring — the exact config proposed in discussion:
#   hop1 (client sidecar -> gateway): ISTIO_MUTUAL + connectionPool (DR1)
#   hop2 (gateway -> external):       raw TCP, NO tls block + connectionPool (DR2)
# Registry domain on this cluster: homelab.local (istiod --domain homelab.local)
apiVersion: networking.istio.io/v1
kind: ServiceEntry
metadata: { name: t91-partner-se, namespace: istio-vt-t91 }
spec:
  hosts: [api.partner.example]
  exportTo: ["."]
  location: MESH_EXTERNAL
  resolution: DNS
  ports:
  - { number: 443, name: tls, protocol: TLS }   # L4 TLS — gateway never parses L7
  endpoints:
  - address: mock.istio-verify-ext.svc.homelab.local   # out-of-mesh echo, self-signed HTTPS
    ports: { tls: 443 }
---
# hop1 server half: dedicated gateway terminates outer ISTIO_MUTUAL on 8443
apiVersion: networking.istio.io/v1
kind: Gateway
metadata: { name: t91-egress-gw, namespace: istio-vt-t91 }
spec:
  selector: { istio: t91-egress }
  servers:
  - port: { number: 8443, name: tls-partner, protocol: TLS }   # TLS, not HTTPS — inner stays opaque
    hosts: [api.partner.example]
    tls: { mode: ISTIO_MUTUAL }
---
# DR1 (hop1): mesh mTLS wrap + connectionPool -> compiles into CLIENT sidecar cluster
apiVersion: networking.istio.io/v1
kind: DestinationRule
metadata: { name: t91-egress-hop1, namespace: istio-vt-t91 }
spec:
  host: t91-egress.istio-vt-t91.svc.homelab.local
  subsets:
  - name: partner
    trafficPolicy:
      portLevelSettings:
      - port: { number: 8443 }
        tls:
          mode: ISTIO_MUTUAL
          sni: api.partner.example
        connectionPool:                       # same port entry as tls — total-replacement rule
          tcp:
            maxConnections: 111               # marker value: hop1
            connectTimeout: 3s
            tcpKeepalive: { time: 300s, interval: 30s, probes: 3 }
---
# DR2 (hop2): NO tls block = raw TCP forward; connectionPool -> compiles into GATEWAY cluster
apiVersion: networking.istio.io/v1
kind: DestinationRule
metadata: { name: t91-partner-tcp, namespace: istio-vt-t91 }
spec:
  host: api.partner.example
  exportTo: ["."]
  trafficPolicy:
    connectionPool:
      tcp:
        maxConnections: 222                   # marker value: hop2
        connectTimeout: 3s
        tcpKeepalive: { time: 300s, interval: 30s, probes: 3 }
---
# VS: leg-1 tls (SNI alive at sidecar) / leg-2 tcp (SNI consumed at gateway termination)
apiVersion: networking.istio.io/v1
kind: VirtualService
metadata: { name: t91-partner-via-egress, namespace: istio-vt-t91 }
spec:
  hosts: [api.partner.example]
  gateways: [mesh, istio-vt-t91/t91-egress-gw]
  exportTo: ["."]
  tls:
  - match:
    - gateways: [mesh]
      port: 443
      sniHosts: [api.partner.example]
    route:
    - destination:
        host: t91-egress.istio-vt-t91.svc.homelab.local
        subset: partner
        port: { number: 8443 }
  tcp:
  - match:
    - gateways: [istio-vt-t91/t91-egress-gw]
      port: 8443
    route:
    - destination:
        host: api.partner.example
        port: { number: 443 }
