apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
  name: example-gateway
  namespace: gwtest
spec:
  gatewayClassName: kgateway
  listeners:
  - name: https
    port: 8443
    protocol: HTTPS
    hostname: www.example.com
    allowedRoutes:
      namespaces:
        from: All
---
apiVersion: v1
kind: Service
metadata:
  name: example-svc
  namespace: gwtest
spec:
  ports:
  - port: 80
    protocol: TCP
    targetPort: 8080
  selector:
    app: example
---
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: test-route
  namespace: gwtest
spec:
  parentRefs:
  - name: example-gateway
  rules:
  - backendRefs:
    - name: example-svc
      port: 80
---
apiVersion: gateway.kgateway.dev/v1alpha1
kind: BackendConfigPolicy
metadata:
  name: san-no-root-ca-policy
  namespace: gwtest
spec:
  targetRefs:
  - group: ""
    kind: Service
    name: example-svc
  tls:
    # No secretRef, tlsFiles, or wellKnownCACertificates - no root CA provided
    insecureSkipVerify: false
    sni: "backend.example.com"
    # SAN verification specified but no root CA - should cause error
    verifySubjectAltName:
    - "backend.example.com"
    - "alt.backend.example.com"