{
  "test_id": "T94",
  "date": "2026-07-06",
  "doc": "docs/istio/egress/mtls-passthrough-tcp-ops",
  "environment": {
    "helm_chart": "istio/gateway 1.30.0 (repo: istio-release.storage.googleapis.com/charts)",
    "method": "chart rendering only (helm show values + helm template) — no cluster required"
  },
  "claims": [
    {
      "id": "C1",
      "claim": "gateway chart exposes pod-level securityContext value (default empty {})",
      "result": "helm show values: 'securityContext: {}' present with comment 'If unset, this will be automatically set to the minimum privileges required to bind to port 80 and 443'",
      "verdict": "supported"
    },
    {
      "id": "C2",
      "claim": "when securityContext is unset, chart auto-injects sysctls [net.ipv4.ip_unprivileged_port_start=0] into pod securityContext",
      "result": "default helm template rendering shows exactly that sysctls block on the pod spec",
      "verdict": "supported"
    },
    {
      "id": "C3",
      "claim": "setting values.securityContext replaces the auto default wholesale (no merge) — custom sysctls must re-declare ip_unprivileged_port_start",
      "result": "rendering with securityContext={sysctls:[tcp_tw_reuse=1]} yields ONLY tcp_tw_reuse; ip_unprivileged_port_start absent",
      "verdict": "supported"
    }
  ]
}