From 076a88117a7cd326043252382c0db592539b55f6 Mon Sep 17 00:00:00 2001
From: Patryk Strugacz <patryk.strugacz@sap.com>
Date: Wed, 22 Jan 2025 13:01:34 +0100
Subject: [PATCH 1/5] Tutorial for Egress

---
 .../01-50-send-requests-using-egress.md       | 204 ++++++++++++++++++
 1 file changed, 204 insertions(+)
 create mode 100644 docs/user/tutorials/01-50-send-requests-using-egress.md

diff --git a/docs/user/tutorials/01-50-send-requests-using-egress.md b/docs/user/tutorials/01-50-send-requests-using-egress.md
new file mode 100644
index 000000000..d610b3ba1
--- /dev/null
+++ b/docs/user/tutorials/01-50-send-requests-using-egress.md
@@ -0,0 +1,204 @@
+# Send requests using Istio Egress
+
+## Prerequisites
+
+* You have the Istio module added.
+* To use CLI instruction, you must install [kubectl](https://kubernetes.io/docs/tasks/tools/#kubectl)
+  and [curl](https://curl.se/). Alternatively, you can use Kyma dashboard.
+
+### Configuration
+
+1. Export the following values as environment variables:
+
+    ```bash
+    export NAMESPACE={service-namespace}
+    ```
+
+2. Create a new namespace for the sample application.
+    ```bash
+    kubectl create ns $NAMESPACE
+    kubectl label namespace $NAMESPACE istio-injection=enabled --overwrite
+    ```
+
+3. Enable additional sidecar logs to see egresGateway being used in requests:
+    ```bash
+    kubectl apply -f - <<EOF
+    apiVersion: telemetry.istio.io/v1
+    kind: Telemetry
+    metadata:
+      name: mesh-default
+      namespace: istio-system
+    spec:
+      accessLogging:
+        - providers:
+          - name: envoy
+    EOF
+    ```
+
+4. Apply `curl` deployment to send the requests:
+    ```bash
+    kubectl apply -f - <<EOF
+    apiVersion: v1
+    kind: ServiceAccount
+    metadata:
+      name: curl
+      namespace: ${NAMESPACE}
+    ---
+    apiVersion: v1
+    kind: Service
+    metadata:
+      name: curl
+      namespace: ${NAMESPACE}
+      labels:
+        app: curl
+        service: curl
+    spec:
+      ports:
+      - port: 80
+        name: http
+      selector:
+        app: curl
+    ---
+    apiVersion: apps/v1
+    kind: Deployment
+    metadata:
+      name: curl
+      namespace: ${NAMESPACE}
+    spec:
+      replicas: 1
+      selector:
+        matchLabels:
+          app: curl
+      template:
+        metadata:
+          labels:
+            app: curl
+        spec:
+          terminationGracePeriodSeconds: 0
+          serviceAccountName: curl
+          containers:
+          - name: curl
+            image: curlimages/curl
+            command: ["/bin/sleep", "infinity"]
+            imagePullPolicy: IfNotPresent
+            volumeMounts:
+            - mountPath: /etc/curl/tls
+              name: secret-volume
+          volumes:
+          - name: secret-volume
+            secret:
+              secretName: curl-secret
+              optional: true
+    EOF
+    ```
+
+   Get the `curl` pod:
+    ```bash
+   export SOURCE_POD=$(kubectl get pod -n "$NAMESPACE" -l app=curl -o jsonpath={.items..metadata.name})
+    ```
+
+5. Define a `ServiceEntry`:
+   
+   ```bash
+   kubectl apply -f - <<EOF
+   apiVersion: networking.istio.io/v1
+   kind: ServiceEntry
+   metadata:
+     name: kyma-project
+     namespace: $NAMESPACE
+   spec:
+     hosts:
+     - kyma-project.io
+     ports:
+     - number: 443
+       name: tls
+       protocol: TLS
+     resolution: DNS
+   EOF
+   ```
+   
+   Verify that the `ServiceEntry` was created successfully:
+   ```bash
+   kubectl exec -n "$NAMESPACE" "$SOURCE_POD" -c curl -- curl -sSL -o /dev/null -D - https://kyma-project.io
+   ```
+
+6. Create an egress `Gateway`, `DestinationRule` and `VirtualService` to direct traffic:
+
+```bash
+kubectl apply -f - <<EOF
+apiVersion: networking.istio.io/v1
+kind: Gateway
+metadata:
+  name: istio-egressgateway
+  namespace: ${NAMESPACE}
+spec:
+  selector:
+    istio: egressgateway
+  servers:
+  - port:
+      number: 443
+      name: tls
+      protocol: TLS
+    hosts:
+    - kyma-project.io
+    tls:
+      mode: PASSTHROUGH
+---
+apiVersion: networking.istio.io/v1
+kind: DestinationRule
+metadata:
+  name: egressgateway-for-kyma-project
+  namespace: ${NAMESPACE}
+spec:
+  host: istio-egressgateway.istio-system.svc.cluster.local
+  subsets:
+  - name: kyma-project
+---
+apiVersion: networking.istio.io/v1
+kind: VirtualService
+metadata:
+  name: direct-kyma-project-through-egress-gateway
+  namespace: ${NAMESPACE}
+spec:
+  hosts:
+  - kyma-project.io
+  gateways:
+  - mesh
+  - istio-egressgateway
+  tls:
+  - match:
+    - gateways:
+      - mesh
+      port: 443
+      sniHosts:
+      - kyma-project.io
+    route:
+    - destination:
+        host: istio-egressgateway.istio-system.svc.cluster.local
+        subset: kyma-project
+        port:
+          number: 443
+  - match:
+    - gateways:
+      - istio-egressgateway
+      port: 443
+      sniHosts:
+      - kyma-project.io
+    route:
+    - destination:
+        host: kyma-project.io
+        port:
+          number: 443
+      weight: 100
+EOF
+```
+
+Once again, send an HTTPS reqest:
+```bash
+kubectl exec -n "$NAMESPACE" "$SOURCE_POD" -c curl -- curl -sSL -o /dev/null -D - https://kyma-project.io
+```
+
+Check egress gateway log:
+```bash
+kubectl logs -l istio=egressgateway -n istio-system
+```

From ed5762f670840fe44541786b01aba152099d376d Mon Sep 17 00:00:00 2001
From: Patryk Strugacz <patryk.strugacz@sap.com>
Date: Thu, 23 Jan 2025 14:57:49 +0100
Subject: [PATCH 2/5] CR, fix typo

---
 .../01-50-send-requests-using-egress.md       | 162 +++++++++---------
 1 file changed, 81 insertions(+), 81 deletions(-)

diff --git a/docs/user/tutorials/01-50-send-requests-using-egress.md b/docs/user/tutorials/01-50-send-requests-using-egress.md
index d610b3ba1..9384ae405 100644
--- a/docs/user/tutorials/01-50-send-requests-using-egress.md
+++ b/docs/user/tutorials/01-50-send-requests-using-egress.md
@@ -4,7 +4,7 @@
 
 * You have the Istio module added.
 * To use CLI instruction, you must install [kubectl](https://kubernetes.io/docs/tasks/tools/#kubectl)
-  and [curl](https://curl.se/). Alternatively, you can use Kyma dashboard.
+  and [curl](https://curl.se/).
 
 ### Configuration
 
@@ -20,7 +20,7 @@
     kubectl label namespace $NAMESPACE istio-injection=enabled --overwrite
     ```
 
-3. Enable additional sidecar logs to see egresGateway being used in requests:
+3. Enable additional sidecar logs to see egressGateway being used in requests:
     ```bash
     kubectl apply -f - <<EOF
     apiVersion: telemetry.istio.io/v1
@@ -123,82 +123,82 @@
    ```
 
 6. Create an egress `Gateway`, `DestinationRule` and `VirtualService` to direct traffic:
-
-```bash
-kubectl apply -f - <<EOF
-apiVersion: networking.istio.io/v1
-kind: Gateway
-metadata:
-  name: istio-egressgateway
-  namespace: ${NAMESPACE}
-spec:
-  selector:
-    istio: egressgateway
-  servers:
-  - port:
-      number: 443
-      name: tls
-      protocol: TLS
-    hosts:
-    - kyma-project.io
-    tls:
-      mode: PASSTHROUGH
----
-apiVersion: networking.istio.io/v1
-kind: DestinationRule
-metadata:
-  name: egressgateway-for-kyma-project
-  namespace: ${NAMESPACE}
-spec:
-  host: istio-egressgateway.istio-system.svc.cluster.local
-  subsets:
-  - name: kyma-project
----
-apiVersion: networking.istio.io/v1
-kind: VirtualService
-metadata:
-  name: direct-kyma-project-through-egress-gateway
-  namespace: ${NAMESPACE}
-spec:
-  hosts:
-  - kyma-project.io
-  gateways:
-  - mesh
-  - istio-egressgateway
-  tls:
-  - match:
-    - gateways:
-      - mesh
-      port: 443
-      sniHosts:
-      - kyma-project.io
-    route:
-    - destination:
-        host: istio-egressgateway.istio-system.svc.cluster.local
-        subset: kyma-project
-        port:
-          number: 443
-  - match:
-    - gateways:
-      - istio-egressgateway
-      port: 443
-      sniHosts:
-      - kyma-project.io
-    route:
-    - destination:
-        host: kyma-project.io
-        port:
-          number: 443
-      weight: 100
-EOF
-```
-
-Once again, send an HTTPS reqest:
-```bash
-kubectl exec -n "$NAMESPACE" "$SOURCE_POD" -c curl -- curl -sSL -o /dev/null -D - https://kyma-project.io
-```
-
-Check egress gateway log:
-```bash
-kubectl logs -l istio=egressgateway -n istio-system
-```
+   
+   ```bash
+   kubectl apply -f - <<EOF
+   apiVersion: networking.istio.io/v1
+   kind: Gateway
+   metadata:
+     name: istio-egressgateway
+     namespace: ${NAMESPACE}
+   spec:
+     selector:
+       istio: egressgateway
+     servers:
+     - port:
+         number: 443
+         name: tls
+         protocol: TLS
+       hosts:
+       - kyma-project.io
+       tls:
+         mode: PASSTHROUGH
+   ---
+   apiVersion: networking.istio.io/v1
+   kind: DestinationRule
+   metadata:
+     name: egressgateway-for-kyma-project
+     namespace: ${NAMESPACE}
+   spec:
+     host: istio-egressgateway.istio-system.svc.cluster.local
+     subsets:
+     - name: kyma-project
+   ---
+   apiVersion: networking.istio.io/v1
+   kind: VirtualService
+   metadata:
+     name: direct-kyma-project-through-egress-gateway
+     namespace: ${NAMESPACE}
+   spec:
+     hosts:
+     - kyma-project.io
+     gateways:
+     - mesh
+     - istio-egressgateway
+     tls:
+     - match:
+       - gateways:
+         - mesh
+         port: 443
+         sniHosts:
+         - kyma-project.io
+       route:
+       - destination:
+           host: istio-egressgateway.istio-system.svc.cluster.local
+           subset: kyma-project
+           port:
+             number: 443
+     - match:
+       - gateways:
+         - istio-egressgateway
+         port: 443
+         sniHosts:
+         - kyma-project.io
+       route:
+       - destination:
+           host: kyma-project.io
+           port:
+             number: 443
+         weight: 100
+   EOF
+   ```
+   
+   Once again, send an HTTPS request:
+   ```bash
+   kubectl exec -n "$NAMESPACE" "$SOURCE_POD" -c curl -- curl -sSL -o /dev/null -D - https://kyma-project.io
+   ```
+   
+   You should see the request to `kyma-project.io` in egress gateway log:
+   ```bash
+   kubectl logs -l istio=egressgateway -n istio-system
+   ```

From 777513d333306a903eabeab4a50324b050501819 Mon Sep 17 00:00:00 2001
From: Patryk Strugacz <patryk.strugacz@sap.com>
Date: Fri, 24 Jan 2025 08:34:44 +0100
Subject: [PATCH 3/5] Add more steps, better descriptions, remove request

---
 .../01-50-send-requests-using-egress.md       | 49 ++++++++++++++-----
 1 file changed, 37 insertions(+), 12 deletions(-)

diff --git a/docs/user/tutorials/01-50-send-requests-using-egress.md b/docs/user/tutorials/01-50-send-requests-using-egress.md
index 9384ae405..27dd5d97b 100644
--- a/docs/user/tutorials/01-50-send-requests-using-egress.md
+++ b/docs/user/tutorials/01-50-send-requests-using-egress.md
@@ -2,7 +2,7 @@
 
 ## Prerequisites
 
-* You have the Istio module added.
+* Istio module with egress enabled.
 * To use CLI instruction, you must install [kubectl](https://kubernetes.io/docs/tasks/tools/#kubectl)
   and [curl](https://curl.se/).
 
@@ -20,7 +20,24 @@
     kubectl label namespace $NAMESPACE istio-injection=enabled --overwrite
     ```
 
-3. Enable additional sidecar logs to see egressGateway being used in requests:
+3. Make sure there is an Istio CR with egress enabled:
+   ```bash
+   kubectl apply -f - <<EOF
+   apiVersion: operator.kyma-project.io/v1alpha2
+   kind: Istio
+   metadata:
+     name: default
+     namespace: kyma-system
+     labels:
+       app.kubernetes.io/name: default
+   spec:
+     components:
+       egressGateway:
+         enabled: true
+   EOF
+   ```
+
+4. Enable additional sidecar logs to see egressGateway being used in requests:
     ```bash
     kubectl apply -f - <<EOF
     apiVersion: telemetry.istio.io/v1
@@ -35,7 +52,7 @@
     EOF
     ```
 
-4. Apply `curl` deployment to send the requests:
+5. Apply `curl` deployment to send the requests:
     ```bash
     kubectl apply -f - <<EOF
     apiVersion: v1
@@ -97,7 +114,7 @@
    export SOURCE_POD=$(kubectl get pod -n "$NAMESPACE" -l app=curl -o jsonpath={.items..metadata.name})
     ```
 
-5. Define a `ServiceEntry`:
+6. Define a `ServiceEntry` to allow outbound traffic to the `kyma-project` domain and perform DNS resolution:
    
    ```bash
    kubectl apply -f - <<EOF
@@ -116,13 +133,8 @@
      resolution: DNS
    EOF
    ```
-   
-   Verify that the `ServiceEntry` was created successfully:
-   ```bash
-   kubectl exec -n "$NAMESPACE" "$SOURCE_POD" -c curl -- curl -sSL -o /dev/null -D - https://kyma-project.io
-   ```
 
-6. Create an egress `Gateway`, `DestinationRule` and `VirtualService` to direct traffic:
+7. Create an egress `Gateway`, `DestinationRule` and `VirtualService` to direct traffic:
    
    ```bash
    kubectl apply -f - <<EOF
@@ -193,12 +205,25 @@
    EOF
    ```
    
-   Once again, send an HTTPS request:
+8. Send an HTTPS request to the Kyma project website:
    ```bash
    kubectl exec -n "$NAMESPACE" "$SOURCE_POD" -c curl -- curl -sSL -o /dev/null -D - https://kyma-project.io
    ```
    
-   You should see the request to `kyma-project.io` in egress gateway log:
+   The response from the website should be similar to this one:
+   ```
+   HTTP/2 200
+   accept-ranges: bytes
+   age: 203
+   ...
+   ```
+   
+   Check Istio egress gateway log:
    ```bash
    kubectl logs -l istio=egressgateway -n istio-system
    ```
+
+   You should see the request made by egress gateway in the logs:
+   ```
+   {"requested_server_name":"kyma-project.io","upstream_cluster":"outbound|443||kyma-project.io",[...]}
+   ```

From 6f1a6307ec2ff796d04d6bea40adb4ca51258e08 Mon Sep 17 00:00:00 2001
From: Patryk Strugacz <werdes72@users.noreply.github.com>
Date: Mon, 27 Jan 2025 10:34:18 +0100
Subject: [PATCH 4/5] Apply suggestions from code review

Co-authored-by: Natalia Sitko <80401180+nataliasitko@users.noreply.github.com>
---
 .../01-50-send-requests-using-egress.md       | 29 ++++++++++---------
 1 file changed, 15 insertions(+), 14 deletions(-)

diff --git a/docs/user/tutorials/01-50-send-requests-using-egress.md b/docs/user/tutorials/01-50-send-requests-using-egress.md
index 27dd5d97b..618682c5c 100644
--- a/docs/user/tutorials/01-50-send-requests-using-egress.md
+++ b/docs/user/tutorials/01-50-send-requests-using-egress.md
@@ -1,26 +1,27 @@
-# Send requests using Istio Egress
+# Send Requests Using Istio Egress Gateway
+Learn how to configure and use the Istio egress Gateway to allow outbound traffic from your Kyma runtime cluster to specific external destinations. Test your configuration by sending an HTTPS request to an external website using a sample Deployment.
 
 ## Prerequisites
 
-* Istio module with egress enabled.
+* You have the Istio module added.
 * To use CLI instruction, you must install [kubectl](https://kubernetes.io/docs/tasks/tools/#kubectl)
   and [curl](https://curl.se/).
 
-### Configuration
+## Steps
 
-1. Export the following values as environment variables:
+1. Export the following value as an environment variable:
 
     ```bash
     export NAMESPACE={service-namespace}
     ```
 
-2. Create a new namespace for the sample application.
+2. Create a new namespace for the sample application:
     ```bash
     kubectl create ns $NAMESPACE
     kubectl label namespace $NAMESPACE istio-injection=enabled --overwrite
     ```
 
-3. Make sure there is an Istio CR with egress enabled:
+3. Enable the egress Gateway in the Istio custom resource:
    ```bash
    kubectl apply -f - <<EOF
    apiVersion: operator.kyma-project.io/v1alpha2
@@ -37,7 +38,7 @@
    EOF
    ```
 
-4. Enable additional sidecar logs to see egressGateway being used in requests:
+4. Enable additional sidecar logs to see the egress Gateway being used in requests:
     ```bash
     kubectl apply -f - <<EOF
     apiVersion: telemetry.istio.io/v1
@@ -52,7 +53,7 @@
     EOF
     ```
 
-5. Apply `curl` deployment to send the requests:
+5. Apply the `curl` Deployment to send the requests:
     ```bash
     kubectl apply -f - <<EOF
     apiVersion: v1
@@ -109,12 +110,12 @@
     EOF
     ```
 
-   Get the `curl` pod:
+   Export the name of the `curl` Pod:
     ```bash
    export SOURCE_POD=$(kubectl get pod -n "$NAMESPACE" -l app=curl -o jsonpath={.items..metadata.name})
     ```
 
-6. Define a `ServiceEntry` to allow outbound traffic to the `kyma-project` domain and perform DNS resolution:
+6. Define a ServiceEntry to allow outbound traffic to the `kyma-project` domain and perform DNS resolution:
    
    ```bash
    kubectl apply -f - <<EOF
@@ -134,7 +135,7 @@
    EOF
    ```
 
-7. Create an egress `Gateway`, `DestinationRule` and `VirtualService` to direct traffic:
+7. Create an egress Gateway, DestinationRule, and VirtualService to direct traffic:
    
    ```bash
    kubectl apply -f - <<EOF
@@ -210,7 +211,7 @@
    kubectl exec -n "$NAMESPACE" "$SOURCE_POD" -c curl -- curl -sSL -o /dev/null -D - https://kyma-project.io
    ```
    
-   The response from the website should be similar to this one:
+   If successful, you get a response from the website similar to this one:
    ```
    HTTP/2 200
    accept-ranges: bytes
@@ -218,12 +219,12 @@
    ...
    ```
    
-   Check Istio egress gateway log:
+   Check the logs of the Istio egress Gateway:
    ```bash
    kubectl logs -l istio=egressgateway -n istio-system
    ```
 
-   You should see the request made by egress gateway in the logs:
+   You should see the request made by the egress Gateway in the logs:
    ```
    {"requested_server_name":"kyma-project.io","upstream_cluster":"outbound|443||kyma-project.io",[...]}
    ```

From 5095bfa984ebe0eebfa738e97879cf6867d0a5ac Mon Sep 17 00:00:00 2001
From: Patryk Strugacz <patryk.strugacz@sap.com>
Date: Mon, 27 Jan 2025 11:00:47 +0100
Subject: [PATCH 5/5] ServiceEntry fix

---
 docs/user/tutorials/01-50-send-requests-using-egress.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docs/user/tutorials/01-50-send-requests-using-egress.md b/docs/user/tutorials/01-50-send-requests-using-egress.md
index 618682c5c..a03f4837a 100644
--- a/docs/user/tutorials/01-50-send-requests-using-egress.md
+++ b/docs/user/tutorials/01-50-send-requests-using-egress.md
@@ -115,7 +115,7 @@ Learn how to configure and use the Istio egress Gateway to allow outbound traffi
    export SOURCE_POD=$(kubectl get pod -n "$NAMESPACE" -l app=curl -o jsonpath={.items..metadata.name})
     ```
 
-6. Define a ServiceEntry to allow outbound traffic to the `kyma-project` domain and perform DNS resolution:
+6. Define a ServiceEntry which adds the `kyma-project.io` hostname to the mesh:
    
    ```bash
    kubectl apply -f - <<EOF