apiVersion: v1
kind: Service
metadata:
  name: istio-ingressgateway
  annotations:
    beta.cloud.google.com/backend-config: '{"ports": {"http2":"iap-backendconfig"}}'
  labels:
    app: istio-ingressgateway
    istio: ingressgateway
    release: istio
spec:
  # TODO(jlewi):  Why are we hardcoding the ports here? With ASM I believe the service
  # gets created by the gateway defined by ASM.
  # 
  ports:
    - name: status-port
      port: 15020
      protocol: TCP
      targetPort: 15020
    - name: http2
      port: 80
      protocol: TCP
      targetPort: 80
    - name: https
      port: 443
      protocol: TCP
      targetPort: 443
    - name: kiali
      port: 15029
      protocol: TCP
      targetPort: 15029
    - name: prometheus
      port: 15030
      protocol: TCP
      targetPort: 15030
    - name: grafana
      port: 15031
      protocol: TCP
      targetPort: 15031
    - name: tracing
      port: 15032
      protocol: TCP
      targetPort: 15032
    - name: tls
      port: 15443
      protocol: TCP
      targetPort: 15443
  selector:
    app: istio-ingressgateway
    istio: ingressgateway
  sessionAffinity: None
  type: NodePort
---
apiVersion: rbac.istio.io/v1alpha1
kind: ClusterRbacConfig
metadata:
  name: default
spec:
  mode: ON_WITH_EXCLUSION
  exclusion:
    namespaces:
    - istio-system
