# T91 workloads — mTLS passthrough (HTTPS over mTLS) + connectionPool on both DRs
apiVersion: v1
kind: Namespace
metadata:
  name: istio-vt-t91
  labels: { istio-injection: enabled, test: t91 }
---
# sidecar-injected client
apiVersion: v1
kind: Pod
metadata:
  name: client
  namespace: istio-vt-t91
  labels: { app: client }
spec:
  containers:
  - name: curl
    image: curlimages/curl:8.14.1
    command: ["sleep", "infinity"]
---
# DEDICATED egress gateway (injection template) — shared istio-egressgateway untouched
apiVersion: apps/v1
kind: Deployment
metadata:
  name: t91-egress
  namespace: istio-vt-t91
spec:
  replicas: 1
  selector: { matchLabels: { istio: t91-egress } }
  template:
    metadata:
      annotations:
        inject.istio.io/templates: gateway
      labels:
        istio: t91-egress
        sidecar.istio.io/inject: "true"
    spec:
      containers:
      - name: istio-proxy
        image: auto
---
apiVersion: v1
kind: Service
metadata:
  name: t91-egress
  namespace: istio-vt-t91
spec:
  selector: { istio: t91-egress }
  ports:
  - { name: tls, port: 8443, targetPort: 8443 }
