Fix mTLS support in an Istio service mesh

When mTLS was enabled in the Istio service mesh, the communication
between Gerrit pods was not always working reliably.

This change adds DestinationRules to enforce ISTIO_MUTUAL, if
configured.

Change-Id: I02e10518eb39ceb4a81e520d4c4c09a5cad29519
diff --git a/Documentation/examples/1-gerritcluster.yaml b/Documentation/examples/1-gerritcluster.yaml
index be5f033..4cf206f 100644
--- a/Documentation/examples/1-gerritcluster.yaml
+++ b/Documentation/examples/1-gerritcluster.yaml
@@ -1,4 +1,4 @@
-apiVersion: "gerritoperator.google.com/v1beta16"
+apiVersion: "gerritoperator.google.com/v1beta17"
 kind: GerritCluster
 metadata:
   name: gerrit
diff --git a/Documentation/examples/2-gerritcluster-with-replica.yaml b/Documentation/examples/2-gerritcluster-with-replica.yaml
index 6c490dd..83093c4 100644
--- a/Documentation/examples/2-gerritcluster-with-replica.yaml
+++ b/Documentation/examples/2-gerritcluster-with-replica.yaml
@@ -1,4 +1,4 @@
-apiVersion: "gerritoperator.google.com/v1beta16"
+apiVersion: "gerritoperator.google.com/v1beta17"
 kind: GerritCluster
 metadata:
   name: gerrit
diff --git a/Documentation/examples/3-gerritcluster-istio.yaml b/Documentation/examples/3-gerritcluster-istio.yaml
index a0ad6bc..a7b820f 100644
--- a/Documentation/examples/3-gerritcluster-istio.yaml
+++ b/Documentation/examples/3-gerritcluster-istio.yaml
@@ -1,4 +1,4 @@
-apiVersion: "gerritoperator.google.com/v1beta16"
+apiVersion: "gerritoperator.google.com/v1beta17"
 kind: GerritCluster
 metadata:
   name: gerrit
diff --git a/Documentation/examples/4-gerritcluster-ha-replica.yaml b/Documentation/examples/4-gerritcluster-ha-replica.yaml
index 308285d..cb6b1c0 100644
--- a/Documentation/examples/4-gerritcluster-ha-replica.yaml
+++ b/Documentation/examples/4-gerritcluster-ha-replica.yaml
@@ -1,4 +1,4 @@
-apiVersion: "gerritoperator.google.com/v1beta16"
+apiVersion: "gerritoperator.google.com/v1beta17"
 kind: GerritCluster
 metadata:
   name: gerrit
diff --git a/Documentation/examples/5-gerritcluster-refdb.yaml b/Documentation/examples/5-gerritcluster-refdb.yaml
index 9773d47..0281aed 100644
--- a/Documentation/examples/5-gerritcluster-refdb.yaml
+++ b/Documentation/examples/5-gerritcluster-refdb.yaml
@@ -1,4 +1,4 @@
-apiVersion: "gerritoperator.google.com/v1beta16"
+apiVersion: "gerritoperator.google.com/v1beta17"
 kind: GerritCluster
 metadata:
   name: gerrit
diff --git a/Documentation/examples/6-gerritcluster-ha-primary.yaml b/Documentation/examples/6-gerritcluster-ha-primary.yaml
index 4b67609..dd1926d 100644
--- a/Documentation/examples/6-gerritcluster-ha-primary.yaml
+++ b/Documentation/examples/6-gerritcluster-ha-primary.yaml
@@ -1,4 +1,4 @@
-apiVersion: "gerritoperator.google.com/v1beta16"
+apiVersion: "gerritoperator.google.com/v1beta17"
 kind: GerritCluster
 metadata:
   name: gerrit
diff --git a/Documentation/examples/gerritcluster-3-nodes-pr-kafka-multisite.yaml b/Documentation/examples/gerritcluster-3-nodes-pr-kafka-multisite.yaml
index 58bb493..a5ba33c 100644
--- a/Documentation/examples/gerritcluster-3-nodes-pr-kafka-multisite.yaml
+++ b/Documentation/examples/gerritcluster-3-nodes-pr-kafka-multisite.yaml
@@ -16,7 +16,7 @@
 type: Opaque
 
 ---
-apiVersion: "gerritoperator.google.com/v1beta16"
+apiVersion: "gerritoperator.google.com/v1beta17"
 kind: GerritCluster
 metadata:
   name: gerrit
diff --git a/Documentation/operator-api-reference.md b/Documentation/operator-api-reference.md
index 20dafe3..53a10a3 100644
--- a/Documentation/operator-api-reference.md
+++ b/Documentation/operator-api-reference.md
@@ -87,7 +87,7 @@
 ---
 
 **Group**: gerritoperator.google.com \
-**Version**: v1beta16 \
+**Version**: v1beta17 \
 **Kind**: GerritCluster
 
 ---
@@ -104,7 +104,7 @@
 Example:
 
 ```yaml
-apiVersion: "gerritoperator.google.com/v1beta16"
+apiVersion: "gerritoperator.google.com/v1beta17"
 kind: GerritCluster
 metadata:
   name: gerrit
@@ -164,6 +164,7 @@
     istio:
       gatewaySelector:
         istio: ingressgateway
+      mTLS: true
 
   refdb:
     database: NONE
@@ -426,7 +427,7 @@
 ---
 
 **Group**: gerritoperator.google.com \
-**Version**: v1beta16 \
+**Version**: v1beta17 \
 **Kind**: Gerrit
 
 ---
@@ -443,7 +444,7 @@
 Example:
 
 ```yaml
-apiVersion: "gerritoperator.google.com/v1beta16"
+apiVersion: "gerritoperator.google.com/v1beta17"
 kind: Gerrit
 metadata:
   name: gerrit
@@ -657,7 +658,7 @@
 ---
 
 **Group**: gerritoperator.google.com \
-**Version**: v1beta16 \
+**Version**: v1beta17 \
 **Kind**: Receiver
 
 ---
@@ -674,7 +675,7 @@
 Example:
 
 ```yaml
-apiVersion: "gerritoperator.google.com/v1beta16"
+apiVersion: "gerritoperator.google.com/v1beta17"
 kind: Receiver
 metadata:
   name: receiver
@@ -785,7 +786,7 @@
 ---
 
 **Group**: gerritoperator.google.com \
-**Version**: v1beta16 \
+**Version**: v1beta17 \
 **Kind**: GitGarbageCollection
 
 ---
@@ -802,7 +803,7 @@
 Example:
 
 ```yaml
-apiVersion: "gerritoperator.google.com/v1beta16"
+apiVersion: "gerritoperator.google.com/v1beta17"
 kind: GitGarbageCollection
 metadata:
   name: gitgc
@@ -846,7 +847,7 @@
 ---
 
 **Group**: gerritoperator.google.com \
-**Version**: v1beta16 \
+**Version**: v1beta17 \
 **Kind**: GerritNetwork
 
 ---
@@ -862,7 +863,7 @@
 Example:
 
 ```yaml
-apiVersion: "gerritoperator.google.com/v1beta16"
+apiVersion: "gerritoperator.google.com/v1beta17"
 kind: GerritNetwork
 metadata:
   name: gerrit-network
@@ -877,6 +878,7 @@
     istio:
       gatewaySelector:
         istio: ingressgateway
+      mTLS: true
   receiver:
     name: receiver
     httpPort: 80
@@ -895,7 +897,7 @@
 ---
 
 **Group**: gerritoperator.google.com \
-**Version**: v1beta16 \
+**Version**: v1beta17 \
 **Kind**: IncomingReplicationTask
 
 ---
@@ -911,7 +913,7 @@
 Example:
 
 ```yaml
-apiVersion: "gerritoperator.google.com/v1beta16"
+apiVersion: "gerritoperator.google.com/v1beta17"
 kind: IncomingReplicationTask
 metadata:
   name: incoming-repl-task
@@ -970,7 +972,7 @@
 ---
 
 **Group**: gerritoperator.google.com \
-**Version**: v1beta16 \
+**Version**: v1beta17 \
 **Kind**: GerritIndexer
 
 ---
@@ -986,7 +988,7 @@
 Example:
 
 ```yaml
-apiVersion: "gerritoperator.google.com/v1beta16"
+apiVersion: "gerritoperator.google.com/v1beta17"
 kind: GerritIndexer
 metadata:
   name: gerrit-indexer
@@ -1169,6 +1171,7 @@
 | Field | Type | Description |
 |---|---|---|
 | `gatewaySelector` | `Map<String, String>` | Labels used to select the Istio Ingressgateway Deployment to use (default: `istio: ingressgateway`) |
+| `mTLS` | `boolean` | Whether mTLS is enabled in the Istio service mesh (default: `false`) |
 
 ## GlobalRefDbConfig
 
diff --git a/crd/current/gerritclusters.gerritoperator.google.com-v1.yml b/crd/current/gerritclusters.gerritoperator.google.com-v1.yml
index 192598b..54914f2 100644
--- a/crd/current/gerritclusters.gerritoperator.google.com-v1.yml
+++ b/crd/current/gerritclusters.gerritoperator.google.com-v1.yml
@@ -13,7 +13,7 @@
     singular: gerritcluster
   scope: Namespaced
   versions:
-  - name: v1beta16
+  - name: v1beta17
     schema:
       openAPIV3Schema:
         properties:
@@ -914,6 +914,8 @@
                         additionalProperties:
                           type: string
                         type: object
+                      mTLS:
+                        type: boolean
                     type: object
                   pathPrefix:
                     type: string
diff --git a/crd/current/gerritindexers.gerritoperator.google.com-v1.yml b/crd/current/gerritindexers.gerritoperator.google.com-v1.yml
index 586531b..1603b3c 100644
--- a/crd/current/gerritindexers.gerritoperator.google.com-v1.yml
+++ b/crd/current/gerritindexers.gerritoperator.google.com-v1.yml
@@ -13,7 +13,7 @@
     singular: gerritindexer
   scope: Namespaced
   versions:
-  - name: v1beta16
+  - name: v1beta17
     schema:
       openAPIV3Schema:
         properties:
diff --git a/crd/current/gerritmaintenances.gerritoperator.google.com-v1.yml b/crd/current/gerritmaintenances.gerritoperator.google.com-v1.yml
index b633fb1..f5c6c18 100644
--- a/crd/current/gerritmaintenances.gerritoperator.google.com-v1.yml
+++ b/crd/current/gerritmaintenances.gerritoperator.google.com-v1.yml
@@ -11,7 +11,7 @@
     singular: gerritmaintenance
   scope: Namespaced
   versions:
-  - name: v1beta16
+  - name: v1beta17
     schema:
       openAPIV3Schema:
         properties:
diff --git a/crd/current/gerritnetworks.gerritoperator.google.com-v1.yml b/crd/current/gerritnetworks.gerritoperator.google.com-v1.yml
index e1f1562..ac47f95 100644
--- a/crd/current/gerritnetworks.gerritoperator.google.com-v1.yml
+++ b/crd/current/gerritnetworks.gerritoperator.google.com-v1.yml
@@ -13,7 +13,7 @@
     singular: gerritnetwork
   scope: Namespaced
   versions:
-  - name: v1beta16
+  - name: v1beta17
     schema:
       openAPIV3Schema:
         properties:
@@ -53,6 +53,8 @@
                         additionalProperties:
                           type: string
                         type: object
+                      mTLS:
+                        type: boolean
                     type: object
                   pathPrefix:
                     type: string
diff --git a/crd/current/gerrits.gerritoperator.google.com-v1.yml b/crd/current/gerrits.gerritoperator.google.com-v1.yml
index bd20b5d..3d8a00b 100644
--- a/crd/current/gerrits.gerritoperator.google.com-v1.yml
+++ b/crd/current/gerrits.gerritoperator.google.com-v1.yml
@@ -13,7 +13,7 @@
     singular: gerrit
   scope: Namespaced
   versions:
-  - name: v1beta16
+  - name: v1beta17
     schema:
       openAPIV3Schema:
         properties:
diff --git a/crd/current/gitgcs.gerritoperator.google.com-v1.yml b/crd/current/gitgcs.gerritoperator.google.com-v1.yml
index a5756d3..6d70443 100644
--- a/crd/current/gitgcs.gerritoperator.google.com-v1.yml
+++ b/crd/current/gitgcs.gerritoperator.google.com-v1.yml
@@ -13,7 +13,7 @@
     singular: gitgarbagecollection
   scope: Namespaced
   versions:
-  - name: v1beta16
+  - name: v1beta17
     schema:
       openAPIV3Schema:
         properties:
diff --git a/crd/current/incomingreplicationtasks.gerritoperator.google.com-v1.yml b/crd/current/incomingreplicationtasks.gerritoperator.google.com-v1.yml
index 5fab4ad..7c00b02 100644
--- a/crd/current/incomingreplicationtasks.gerritoperator.google.com-v1.yml
+++ b/crd/current/incomingreplicationtasks.gerritoperator.google.com-v1.yml
@@ -11,7 +11,7 @@
     singular: incomingreplicationtask
   scope: Namespaced
   versions:
-  - name: v1beta16
+  - name: v1beta17
     schema:
       openAPIV3Schema:
         properties:
diff --git a/crd/current/receivers.gerritoperator.google.com-v1.yml b/crd/current/receivers.gerritoperator.google.com-v1.yml
index ded8d2c..f3f1fe1 100644
--- a/crd/current/receivers.gerritoperator.google.com-v1.yml
+++ b/crd/current/receivers.gerritoperator.google.com-v1.yml
@@ -13,7 +13,7 @@
     singular: receiver
   scope: Namespaced
   versions:
-  - name: v1beta16
+  - name: v1beta17
     schema:
       openAPIV3Schema:
         properties:
diff --git a/crd/deprecated/gerritclusters.gerritoperator.google.com-v1.yml b/crd/deprecated/gerritclusters.gerritoperator.google.com-v1.yml
index 31c484b..524d335 100644
--- a/crd/deprecated/gerritclusters.gerritoperator.google.com-v1.yml
+++ b/crd/deprecated/gerritclusters.gerritoperator.google.com-v1.yml
@@ -13,7 +13,7 @@
     singular: gerritcluster
   scope: Namespaced
   versions:
-    - name: v1beta15
+    - name: v1beta16
       schema:
         openAPIV3Schema:
           properties:
@@ -1566,10 +1566,22 @@
                   properties:
                     database:
                       enum:
+                        - DYNAMODB
                         - NONE
                         - SPANNER
                         - ZOOKEEPER
                       type: string
+                    dynamoDb:
+                      properties:
+                        endpoint:
+                          type: string
+                        locksTableName:
+                          type: string
+                        refsDbTableName:
+                          type: string
+                        region:
+                          type: string
+                      type: object
                     spanner:
                       properties:
                         database:
diff --git a/crd/deprecated/gerritindexers.gerritoperator.google.com-v1.yml b/crd/deprecated/gerritindexers.gerritoperator.google.com-v1.yml
index fe2574a..803a6b3 100644
--- a/crd/deprecated/gerritindexers.gerritoperator.google.com-v1.yml
+++ b/crd/deprecated/gerritindexers.gerritoperator.google.com-v1.yml
@@ -13,7 +13,7 @@
     singular: gerritindexer
   scope: Namespaced
   versions:
-    - name: v1beta15
+    - name: v1beta16
       schema:
         openAPIV3Schema:
           properties:
diff --git a/crd/deprecated/gerritmaintenances.gerritoperator.google.com-v1.yml b/crd/deprecated/gerritmaintenances.gerritoperator.google.com-v1.yml
index 800a9ff..91bbfb7 100644
--- a/crd/deprecated/gerritmaintenances.gerritoperator.google.com-v1.yml
+++ b/crd/deprecated/gerritmaintenances.gerritoperator.google.com-v1.yml
@@ -11,7 +11,7 @@
     singular: gerritmaintenance
   scope: Namespaced
   versions:
-    - name: v1beta15
+    - name: v1beta16
       schema:
         openAPIV3Schema:
           properties:
diff --git a/crd/deprecated/gerritnetworks.gerritoperator.google.com-v1.yml b/crd/deprecated/gerritnetworks.gerritoperator.google.com-v1.yml
index d5ebe0f..6916ebf 100644
--- a/crd/deprecated/gerritnetworks.gerritoperator.google.com-v1.yml
+++ b/crd/deprecated/gerritnetworks.gerritoperator.google.com-v1.yml
@@ -13,7 +13,7 @@
     singular: gerritnetwork
   scope: Namespaced
   versions:
-    - name: v1beta15
+    - name: v1beta16
       schema:
         openAPIV3Schema:
           properties:
diff --git a/crd/deprecated/gerrits.gerritoperator.google.com-v1.yml b/crd/deprecated/gerrits.gerritoperator.google.com-v1.yml
index a6942f2..c549565 100644
--- a/crd/deprecated/gerrits.gerritoperator.google.com-v1.yml
+++ b/crd/deprecated/gerrits.gerritoperator.google.com-v1.yml
@@ -13,7 +13,7 @@
     singular: gerrit
   scope: Namespaced
   versions:
-    - name: v1beta15
+    - name: v1beta16
       schema:
         openAPIV3Schema:
           properties:
@@ -663,10 +663,22 @@
                   properties:
                     database:
                       enum:
+                        - DYNAMODB
                         - NONE
                         - SPANNER
                         - ZOOKEEPER
                       type: string
+                    dynamoDb:
+                      properties:
+                        endpoint:
+                          type: string
+                        locksTableName:
+                          type: string
+                        refsDbTableName:
+                          type: string
+                        region:
+                          type: string
+                      type: object
                     spanner:
                       properties:
                         database:
diff --git a/crd/deprecated/gitgcs.gerritoperator.google.com-v1.yml b/crd/deprecated/gitgcs.gerritoperator.google.com-v1.yml
index ff0cc93..fc2f252 100644
--- a/crd/deprecated/gitgcs.gerritoperator.google.com-v1.yml
+++ b/crd/deprecated/gitgcs.gerritoperator.google.com-v1.yml
@@ -13,7 +13,7 @@
     singular: gitgarbagecollection
   scope: Namespaced
   versions:
-    - name: v1beta15
+    - name: v1beta16
       schema:
         openAPIV3Schema:
           properties:
diff --git a/crd/deprecated/incomingreplicationtasks.gerritoperator.google.com-v1.yml b/crd/deprecated/incomingreplicationtasks.gerritoperator.google.com-v1.yml
index 9469597..6aa75fe 100644
--- a/crd/deprecated/incomingreplicationtasks.gerritoperator.google.com-v1.yml
+++ b/crd/deprecated/incomingreplicationtasks.gerritoperator.google.com-v1.yml
@@ -11,7 +11,7 @@
     singular: incomingreplicationtask
   scope: Namespaced
   versions:
-    - name: v1beta15
+    - name: v1beta16
       schema:
         openAPIV3Schema:
           properties:
diff --git a/crd/deprecated/receivers.gerritoperator.google.com-v1.yml b/crd/deprecated/receivers.gerritoperator.google.com-v1.yml
index 8343a1e..6aa02a4 100644
--- a/crd/deprecated/receivers.gerritoperator.google.com-v1.yml
+++ b/crd/deprecated/receivers.gerritoperator.google.com-v1.yml
@@ -13,7 +13,7 @@
     singular: receiver
   scope: Namespaced
   versions:
-    - name: v1beta15
+    - name: v1beta16
       schema:
         openAPIV3Schema:
           properties:
diff --git a/helm-charts/gerrit-operator-crds/templates/gerritclusters.gerritoperator.google.com-v1.yml b/helm-charts/gerrit-operator-crds/templates/gerritclusters.gerritoperator.google.com-v1.yml
index 3010ba2..94c43d3 100644
--- a/helm-charts/gerrit-operator-crds/templates/gerritclusters.gerritoperator.google.com-v1.yml
+++ b/helm-charts/gerrit-operator-crds/templates/gerritclusters.gerritoperator.google.com-v1.yml
@@ -13,7 +13,7 @@
     singular: gerritcluster
   scope: Namespaced
   versions:
-    - name: v1beta16
+    - name: v1beta17
       schema:
         openAPIV3Schema:
           properties:
@@ -914,6 +914,8 @@
                           additionalProperties:
                             type: string
                           type: object
+                        mTLS:
+                          type: boolean
                       type: object
                     pathPrefix:
                       type: string
@@ -2561,7 +2563,7 @@
       storage: true
       subresources:
         status: {}
-    - name: v1beta15
+    - name: v1beta16
       schema:
         openAPIV3Schema:
           properties:
@@ -4114,10 +4116,22 @@
                   properties:
                     database:
                       enum:
+                        - DYNAMODB
                         - NONE
                         - SPANNER
                         - ZOOKEEPER
                       type: string
+                    dynamoDb:
+                      properties:
+                        endpoint:
+                          type: string
+                        locksTableName:
+                          type: string
+                        refsDbTableName:
+                          type: string
+                        region:
+                          type: string
+                      type: object
                     spanner:
                       properties:
                         database:
diff --git a/helm-charts/gerrit-operator-crds/templates/gerritindexers.gerritoperator.google.com-v1.yml b/helm-charts/gerrit-operator-crds/templates/gerritindexers.gerritoperator.google.com-v1.yml
index 46f26d3..4e5f95a 100644
--- a/helm-charts/gerrit-operator-crds/templates/gerritindexers.gerritoperator.google.com-v1.yml
+++ b/helm-charts/gerrit-operator-crds/templates/gerritindexers.gerritoperator.google.com-v1.yml
@@ -13,7 +13,7 @@
     singular: gerritindexer
   scope: Namespaced
   versions:
-    - name: v1beta16
+    - name: v1beta17
       schema:
         openAPIV3Schema:
           properties:
@@ -487,7 +487,7 @@
       storage: true
       subresources:
         status: {}
-    - name: v1beta15
+    - name: v1beta16
       schema:
         openAPIV3Schema:
           properties:
diff --git a/helm-charts/gerrit-operator-crds/templates/gerritmaintenances.gerritoperator.google.com-v1.yml b/helm-charts/gerrit-operator-crds/templates/gerritmaintenances.gerritoperator.google.com-v1.yml
index c038fe3..ef2204a 100644
--- a/helm-charts/gerrit-operator-crds/templates/gerritmaintenances.gerritoperator.google.com-v1.yml
+++ b/helm-charts/gerrit-operator-crds/templates/gerritmaintenances.gerritoperator.google.com-v1.yml
@@ -11,7 +11,7 @@
     singular: gerritmaintenance
   scope: Namespaced
   versions:
-    - name: v1beta16
+    - name: v1beta17
       schema:
         openAPIV3Schema:
           properties:
@@ -555,7 +555,7 @@
       storage: true
       subresources:
         status: {}
-    - name: v1beta15
+    - name: v1beta16
       schema:
         openAPIV3Schema:
           properties:
diff --git a/helm-charts/gerrit-operator-crds/templates/gerritnetworks.gerritoperator.google.com-v1.yml b/helm-charts/gerrit-operator-crds/templates/gerritnetworks.gerritoperator.google.com-v1.yml
index 037573a..5bb8b53 100644
--- a/helm-charts/gerrit-operator-crds/templates/gerritnetworks.gerritoperator.google.com-v1.yml
+++ b/helm-charts/gerrit-operator-crds/templates/gerritnetworks.gerritoperator.google.com-v1.yml
@@ -13,7 +13,7 @@
     singular: gerritnetwork
   scope: Namespaced
   versions:
-    - name: v1beta16
+    - name: v1beta17
       schema:
         openAPIV3Schema:
           properties:
@@ -53,6 +53,8 @@
                           additionalProperties:
                             type: string
                           type: object
+                        mTLS:
+                          type: boolean
                       type: object
                     pathPrefix:
                       type: string
@@ -141,7 +143,7 @@
       storage: true
       subresources:
         status: {}
-    - name: v1beta15
+    - name: v1beta16
       schema:
         openAPIV3Schema:
           properties:
diff --git a/helm-charts/gerrit-operator-crds/templates/gerrits.gerritoperator.google.com-v1.yml b/helm-charts/gerrit-operator-crds/templates/gerrits.gerritoperator.google.com-v1.yml
index e1b29a0..5ff69a2 100644
--- a/helm-charts/gerrit-operator-crds/templates/gerrits.gerritoperator.google.com-v1.yml
+++ b/helm-charts/gerrit-operator-crds/templates/gerrits.gerritoperator.google.com-v1.yml
@@ -13,7 +13,7 @@
     singular: gerrit
   scope: Namespaced
   versions:
-    - name: v1beta16
+    - name: v1beta17
       schema:
         openAPIV3Schema:
           properties:
@@ -947,7 +947,7 @@
       storage: true
       subresources:
         status: {}
-    - name: v1beta15
+    - name: v1beta16
       schema:
         openAPIV3Schema:
           properties:
@@ -1597,10 +1597,22 @@
                   properties:
                     database:
                       enum:
+                        - DYNAMODB
                         - NONE
                         - SPANNER
                         - ZOOKEEPER
                       type: string
+                    dynamoDb:
+                      properties:
+                        endpoint:
+                          type: string
+                        locksTableName:
+                          type: string
+                        refsDbTableName:
+                          type: string
+                        region:
+                          type: string
+                      type: object
                     spanner:
                       properties:
                         database:
diff --git a/helm-charts/gerrit-operator-crds/templates/gitgcs.gerritoperator.google.com-v1.yml b/helm-charts/gerrit-operator-crds/templates/gitgcs.gerritoperator.google.com-v1.yml
index 6a6da61..780c9a7 100644
--- a/helm-charts/gerrit-operator-crds/templates/gitgcs.gerritoperator.google.com-v1.yml
+++ b/helm-charts/gerrit-operator-crds/templates/gitgcs.gerritoperator.google.com-v1.yml
@@ -13,7 +13,7 @@
     singular: gitgarbagecollection
   scope: Namespaced
   versions:
-    - name: v1beta16
+    - name: v1beta17
       schema:
         openAPIV3Schema:
           properties:
@@ -422,7 +422,7 @@
       storage: true
       subresources:
         status: {}
-    - name: v1beta15
+    - name: v1beta16
       schema:
         openAPIV3Schema:
           properties:
diff --git a/helm-charts/gerrit-operator-crds/templates/incomingreplicationtasks.gerritoperator.google.com-v1.yml b/helm-charts/gerrit-operator-crds/templates/incomingreplicationtasks.gerritoperator.google.com-v1.yml
index acf0b0c..1c78390 100644
--- a/helm-charts/gerrit-operator-crds/templates/incomingreplicationtasks.gerritoperator.google.com-v1.yml
+++ b/helm-charts/gerrit-operator-crds/templates/incomingreplicationtasks.gerritoperator.google.com-v1.yml
@@ -11,7 +11,7 @@
     singular: incomingreplicationtask
   scope: Namespaced
   versions:
-    - name: v1beta16
+    - name: v1beta17
       schema:
         openAPIV3Schema:
           properties:
@@ -568,7 +568,7 @@
       storage: true
       subresources:
         status: {}
-    - name: v1beta15
+    - name: v1beta16
       schema:
         openAPIV3Schema:
           properties:
diff --git a/helm-charts/gerrit-operator-crds/templates/receivers.gerritoperator.google.com-v1.yml b/helm-charts/gerrit-operator-crds/templates/receivers.gerritoperator.google.com-v1.yml
index baf05f4..8bfbf2e 100644
--- a/helm-charts/gerrit-operator-crds/templates/receivers.gerritoperator.google.com-v1.yml
+++ b/helm-charts/gerrit-operator-crds/templates/receivers.gerritoperator.google.com-v1.yml
@@ -13,7 +13,7 @@
     singular: receiver
   scope: Namespaced
   versions:
-    - name: v1beta16
+    - name: v1beta17
       schema:
         openAPIV3Schema:
           properties:
@@ -687,7 +687,7 @@
       storage: true
       subresources:
         status: {}
-    - name: v1beta15
+    - name: v1beta16
       schema:
         openAPIV3Schema:
           properties:
diff --git a/operator/src/main/java/com/google/gerrit/k8s/operator/Constants.java b/operator/src/main/java/com/google/gerrit/k8s/operator/Constants.java
index 6b7b830..3333d5f 100644
--- a/operator/src/main/java/com/google/gerrit/k8s/operator/Constants.java
+++ b/operator/src/main/java/com/google/gerrit/k8s/operator/Constants.java
@@ -17,7 +17,7 @@
 import com.google.inject.AbstractModule;
 
 public class Constants extends AbstractModule {
-  public static final String VERSION = "v1beta16";
+  public static final String VERSION = "v1beta17";
 
   // The resource kind always has to be plural for use in webhooks
   public static final String GERRIT_CLUSTER_KIND = "gerritclusters";
diff --git a/operator/src/main/java/com/google/gerrit/k8s/operator/api/model/shared/GerritIstioConfig.java b/operator/src/main/java/com/google/gerrit/k8s/operator/api/model/shared/GerritIstioConfig.java
index 4c6318d..0e415ed 100644
--- a/operator/src/main/java/com/google/gerrit/k8s/operator/api/model/shared/GerritIstioConfig.java
+++ b/operator/src/main/java/com/google/gerrit/k8s/operator/api/model/shared/GerritIstioConfig.java
@@ -19,6 +19,7 @@
 
 public class GerritIstioConfig {
   private Map<String, String> gatewaySelector = Map.of("istio", "ingressgateway");
+  private boolean mTLS;
 
   public Map<String, String> getGatewaySelector() {
     return gatewaySelector;
@@ -28,9 +29,17 @@
     this.gatewaySelector = gatewaySelector;
   }
 
+  public boolean ismTLS() {
+    return mTLS;
+  }
+
+  public void setmTLS(boolean mTLS) {
+    this.mTLS = mTLS;
+  }
+
   @Override
   public int hashCode() {
-    return Objects.hash(gatewaySelector);
+    return Objects.hash(gatewaySelector, mTLS);
   }
 
   @Override
@@ -39,11 +48,11 @@
     if (obj == null) return false;
     if (getClass() != obj.getClass()) return false;
     GerritIstioConfig other = (GerritIstioConfig) obj;
-    return Objects.equals(gatewaySelector, other.gatewaySelector);
+    return Objects.equals(gatewaySelector, other.gatewaySelector) && mTLS == other.mTLS;
   }
 
   @Override
   public String toString() {
-    return "GerritIstioConfig [gatewaySelector=" + gatewaySelector + "]";
+    return "GerritIstioConfig [gatewaySelector=" + gatewaySelector + ", mTLS=" + mTLS + "]";
   }
 }
diff --git a/operator/src/main/java/com/google/gerrit/k8s/operator/network/istio/dependent/GerritIstioDestinationRule.java b/operator/src/main/java/com/google/gerrit/k8s/operator/network/istio/dependent/GerritIstioDestinationRule.java
index 4158d79..22d5f46 100644
--- a/operator/src/main/java/com/google/gerrit/k8s/operator/network/istio/dependent/GerritIstioDestinationRule.java
+++ b/operator/src/main/java/com/google/gerrit/k8s/operator/network/istio/dependent/GerritIstioDestinationRule.java
@@ -17,13 +17,19 @@
 import com.google.gerrit.k8s.operator.api.model.gerrit.GerritTemplate;
 import com.google.gerrit.k8s.operator.api.model.network.GerritNetwork;
 import com.google.gerrit.k8s.operator.cluster.GerritClusterLabelFactory;
+import com.google.gerrit.k8s.operator.gerrit.dependent.GerritHeadlessService;
 import com.google.gerrit.k8s.operator.gerrit.dependent.GerritService;
 import com.google.gerrit.k8s.operator.util.CRUDReconcileAddKubernetesDependentResource;
+import io.fabric8.istio.api.networking.v1beta1.ClientTLSSettings;
+import io.fabric8.istio.api.networking.v1beta1.ClientTLSSettingsBuilder;
+import io.fabric8.istio.api.networking.v1beta1.ClientTLSSettingsTLSmode;
 import io.fabric8.istio.api.networking.v1beta1.DestinationRule;
 import io.fabric8.istio.api.networking.v1beta1.DestinationRuleBuilder;
+import io.fabric8.istio.api.networking.v1beta1.LoadBalancerSettings;
+import io.fabric8.istio.api.networking.v1beta1.LoadBalancerSettingsBuilder;
 import io.fabric8.istio.api.networking.v1beta1.LoadBalancerSettingsSimpleLB;
-import io.fabric8.istio.api.networking.v1beta1.TrafficPolicy;
-import io.fabric8.istio.api.networking.v1beta1.TrafficPolicyBuilder;
+import io.fabric8.kubernetes.api.model.ObjectMeta;
+import io.fabric8.kubernetes.api.model.ObjectMetaBuilder;
 import io.javaoperatorsdk.operator.api.reconciler.Context;
 import io.javaoperatorsdk.operator.api.reconciler.dependent.Deleter;
 import io.javaoperatorsdk.operator.processing.dependent.BulkDependentResource;
@@ -39,54 +45,98 @@
     super(DestinationRule.class);
   }
 
-  protected DestinationRule desired(
+  private DestinationRule desired(
       GerritNetwork gerritNetwork, String gerritName, boolean isReplica) {
 
     return new DestinationRuleBuilder()
-        .withNewMetadata()
-        .withName(getName(gerritName))
-        .withNamespace(gerritNetwork.getMetadata().getNamespace())
-        .withLabels(
-            GerritClusterLabelFactory.create(
-                gerritNetwork.getMetadata().getName(),
-                getName(gerritName),
-                this.getClass().getSimpleName()))
-        .endMetadata()
+        .withMetadata(getMetaData(gerritNetwork, gerritName, ""))
         .withNewSpec()
         .withHost(
             new GerritService().getHostname(gerritName, gerritNetwork.getMetadata().getNamespace()))
-        .withTrafficPolicy(getTrafficPolicy(isReplica))
+        .withNewTrafficPolicy()
+        .withLoadBalancer(getLoadBalancerSettings(isReplica))
+        .endTrafficPolicy()
         .endSpec()
         .build();
   }
 
-  private TrafficPolicy getTrafficPolicy(boolean isReplica) {
+  private DestinationRule desiredHeadless(
+      GerritNetwork gerritNetwork, String gerritName, boolean isReplica) {
+
+    return new DestinationRuleBuilder()
+        .withMetadata(getMetaData(gerritNetwork, gerritName, "-headless-service"))
+        .withNewSpec()
+        .withHost(
+            new GerritHeadlessService()
+                .getHostname(gerritName, gerritNetwork.getMetadata().getNamespace()))
+        .withNewTrafficPolicy()
+        .withLoadBalancer(getLoadBalancerSettings(isReplica))
+        .withTls(getTls(gerritNetwork))
+        .endTrafficPolicy()
+        .endSpec()
+        .build();
+  }
+
+  private DestinationRule desiredHeadlessPod(GerritNetwork gerritNetwork, String gerritName) {
+    return new DestinationRuleBuilder()
+        .withMetadata(getMetaData(gerritNetwork, gerritName, "-headless-pods"))
+        .withNewSpec()
+        .withHost(
+            "*."
+                + new GerritHeadlessService()
+                    .getHostname(gerritName, gerritNetwork.getMetadata().getNamespace()))
+        .withNewTrafficPolicy()
+        .withTls(getTls(gerritNetwork))
+        .endTrafficPolicy()
+        .endSpec()
+        .build();
+  }
+
+  private ObjectMeta getMetaData(
+      GerritNetwork gerritNetwork, String gerritName, String nameSuffix) {
+    return new ObjectMetaBuilder()
+        .withName(getName(gerritName, nameSuffix))
+        .withNamespace(gerritNetwork.getMetadata().getNamespace())
+        .withLabels(
+            GerritClusterLabelFactory.create(
+                gerritNetwork.getMetadata().getName(),
+                getName(gerritName, nameSuffix),
+                this.getClass().getSimpleName()))
+        .build();
+  }
+
+  private LoadBalancerSettings getLoadBalancerSettings(boolean isReplica) {
     if (isReplica) {
-      return new TrafficPolicyBuilder()
-          .withNewLoadBalancer()
+      return new LoadBalancerSettingsBuilder()
           .withNewLoadBalancerSettingsSimpleLbPolicy()
           .withSimple(LoadBalancerSettingsSimpleLB.LEAST_CONN)
           .endLoadBalancerSettingsSimpleLbPolicy()
-          .endLoadBalancer()
           .build();
     }
-    return new TrafficPolicyBuilder()
-        .withNewLoadBalancer()
+    return new LoadBalancerSettingsBuilder()
         .withNewLoadBalancerSettingsConsistentHashLbPolicy()
         .withNewConsistentHash()
         .withNewLoadBalancerSettingsConsistentHashLBUseSourceIpKey(true)
         .endConsistentHash()
         .endLoadBalancerSettingsConsistentHashLbPolicy()
-        .endLoadBalancer()
         .build();
   }
 
-  public static String getName(GerritTemplate gerrit) {
-    return gerrit.getMetadata().getName();
+  private ClientTLSSettings getTls(GerritNetwork gerritNetwork) {
+    return new ClientTLSSettingsBuilder()
+        .withMode(
+            gerritNetwork.getSpec().getIngress().getIstio().ismTLS()
+                ? ClientTLSSettingsTLSmode.ISTIO_MUTUAL
+                : ClientTLSSettingsTLSmode.DISABLE)
+        .build();
   }
 
-  public static String getName(String gerritName) {
-    return gerritName;
+  public static String getName(GerritTemplate gerrit, String suffix) {
+    return getName(gerrit.getMetadata().getName(), suffix);
+  }
+
+  public static String getName(String gerritName, String suffix) {
+    return gerritName + suffix;
   }
 
   @Override
@@ -95,11 +145,21 @@
     Map<String, DestinationRule> drs = new HashMap<>();
     if (gerritNetwork.hasPrimaryGerrit()) {
       String primaryGerritName = gerritNetwork.getSpec().getPrimaryGerrit().getName();
-      drs.put(primaryGerritName, desired(gerritNetwork, primaryGerritName, false));
+      DestinationRule dstRule = desired(gerritNetwork, primaryGerritName, false);
+      drs.put(dstRule.getMetadata().getName(), dstRule);
+      DestinationRule dstRuleHeadless = desiredHeadless(gerritNetwork, primaryGerritName, false);
+      drs.put(dstRuleHeadless.getMetadata().getName(), dstRuleHeadless);
+      DestinationRule dstRuleHeadlessPod = desiredHeadlessPod(gerritNetwork, primaryGerritName);
+      drs.put(dstRuleHeadlessPod.getMetadata().getName(), dstRuleHeadlessPod);
     }
     if (gerritNetwork.hasGerritReplica()) {
       String gerritReplicaName = gerritNetwork.getSpec().getGerritReplica().getName();
-      drs.put(gerritReplicaName, desired(gerritNetwork, gerritReplicaName, true));
+      DestinationRule dstRule = desired(gerritNetwork, gerritReplicaName, true);
+      drs.put(dstRule.getMetadata().getName(), dstRule);
+      DestinationRule dstRuleHeadless = desiredHeadless(gerritNetwork, gerritReplicaName, true);
+      drs.put(dstRuleHeadless.getMetadata().getName(), dstRuleHeadless);
+      DestinationRule dstRuleHeadlessPod = desiredHeadlessPod(gerritNetwork, gerritReplicaName);
+      drs.put(dstRuleHeadlessPod.getMetadata().getName(), dstRuleHeadlessPod);
     }
     return drs;
   }
diff --git a/operator/src/test/java/com/google/gerrit/k8s/operator/network/istio/dependent/GerritClusterIstioTest.java b/operator/src/test/java/com/google/gerrit/k8s/operator/network/istio/dependent/GerritClusterIstioTest.java
index b2bb58a..7d473e0 100644
--- a/operator/src/test/java/com/google/gerrit/k8s/operator/network/istio/dependent/GerritClusterIstioTest.java
+++ b/operator/src/test/java/com/google/gerrit/k8s/operator/network/istio/dependent/GerritClusterIstioTest.java
@@ -19,9 +19,12 @@
 import com.google.gerrit.k8s.operator.Constants.ClusterMode;
 import com.google.gerrit.k8s.operator.OperatorContext;
 import com.google.gerrit.k8s.operator.api.model.network.GerritNetwork;
+import io.fabric8.istio.api.networking.v1beta1.DestinationRule;
 import io.fabric8.istio.api.networking.v1beta1.Gateway;
 import io.fabric8.istio.api.networking.v1beta1.VirtualService;
 import io.javaoperatorsdk.operator.ReconcilerUtils;
+import java.util.List;
+import java.util.Map;
 import java.util.stream.Stream;
 import org.junit.jupiter.params.ParameterizedTest;
 import org.junit.jupiter.params.provider.Arguments;
@@ -31,7 +34,10 @@
   @ParameterizedTest
   @MethodSource("provideYamlManifests")
   public void expectedGerritClusterIstioComponentsCreated(
-      String inputFile, String expectedGatewayOutputFile, String expectedVirtualServiceOutputFile) {
+      String inputFile,
+      String expectedGatewayOutputFile,
+      String expectedVirtualServiceOutputFile,
+      List<String> expectedDestRuleFiles) {
     OperatorContext.createInstance(ClusterMode.HIGH_AVAILABILITY, "cluster.local");
     GerritNetwork gerritNetwork =
         ReconcilerUtils.loadYaml(GerritNetwork.class, this.getClass(), inputFile);
@@ -47,6 +53,18 @@
         ReconcilerUtils.loadYaml(
             VirtualService.class, this.getClass(), expectedVirtualServiceOutputFile);
     assertThat(virtualServiceResult.getSpec()).isEqualTo(expectedVirtualService.getSpec());
+
+    GerritIstioDestinationRule destRuleDependent = new GerritIstioDestinationRule();
+    Map<String, DestinationRule> destRuleResult =
+        destRuleDependent.desiredResources(gerritNetwork, null);
+
+    for (String expectedDestRuleFile : expectedDestRuleFiles) {
+      DestinationRule expectedDestRule =
+          ReconcilerUtils.loadYaml(DestinationRule.class, this.getClass(), expectedDestRuleFile);
+      assertThat(destRuleResult).containsKey(expectedDestRule.getMetadata().getName());
+      assertThat(destRuleResult.get(expectedDestRule.getMetadata().getName()).getSpec())
+          .isEqualTo(expectedDestRule.getSpec());
+    }
   }
 
   private static Stream<Arguments> provideYamlManifests() {
@@ -54,40 +72,93 @@
         Arguments.of(
             "../../gerritnetwork_primary_replica_tls.yaml",
             "gateway_tls.yaml",
-            "virtualservice_primary_replica.yaml"),
+            "virtualservice_primary_replica.yaml",
+            List.of(
+                "destinationrule_primary.yaml",
+                "destinationrule_primary_headless.yaml",
+                "destinationrule_primary_headless_pods.yaml",
+                "destinationrule_replica.yaml",
+                "destinationrule_replica_headless.yaml",
+                "destinationrule_replica_headless_pods.yaml")),
         Arguments.of(
             "../../gerritnetwork_primary_replica.yaml",
             "gateway.yaml",
-            "virtualservice_primary_replica.yaml"),
+            "virtualservice_primary_replica.yaml",
+            List.of(
+                "destinationrule_primary.yaml",
+                "destinationrule_primary_headless.yaml",
+                "destinationrule_primary_headless_pods.yaml",
+                "destinationrule_replica.yaml",
+                "destinationrule_replica_headless.yaml",
+                "destinationrule_replica_headless_pods.yaml")),
         Arguments.of(
-            "../../gerritnetwork_primary.yaml", "gateway.yaml", "virtualservice_primary.yaml"),
+            "../../gerritnetwork_primary.yaml",
+            "gateway.yaml",
+            "virtualservice_primary.yaml",
+            List.of(
+                "destinationrule_primary.yaml",
+                "destinationrule_primary_headless.yaml",
+                "destinationrule_primary_headless_pods.yaml")),
         Arguments.of(
-            "../../gerritnetwork_replica.yaml", "gateway.yaml", "virtualservice_replica.yaml"),
+            "../../gerritnetwork_replica.yaml",
+            "gateway.yaml",
+            "virtualservice_replica.yaml",
+            List.of(
+                "destinationrule_replica.yaml",
+                "destinationrule_replica_headless.yaml",
+                "destinationrule_replica_headless_pods.yaml")),
         Arguments.of(
-            "../../gerritnetwork_receiver.yaml", "gateway.yaml", "virtualservice_receiver.yaml"),
+            "../../gerritnetwork_receiver.yaml",
+            "gateway.yaml",
+            "virtualservice_receiver.yaml",
+            List.of()),
         Arguments.of(
             "../../gerritnetwork_receiver_replica.yaml",
             "gateway.yaml",
-            "virtualservice_receiver_replica.yaml"),
+            "virtualservice_receiver_replica.yaml",
+            List.of(
+                "destinationrule_replica.yaml",
+                "destinationrule_replica_headless.yaml",
+                "destinationrule_replica_headless_pods.yaml")),
         Arguments.of(
             "../../gerritnetwork_receiver_replica_tls.yaml",
             "gateway_tls.yaml",
-            "virtualservice_receiver_replica.yaml"),
+            "virtualservice_receiver_replica.yaml",
+            List.of(
+                "destinationrule_replica.yaml",
+                "destinationrule_replica_headless.yaml",
+                "destinationrule_replica_headless_pods.yaml")),
         Arguments.of(
             "../../gerritnetwork_primary_ssh.yaml",
             "gateway_primary_ssh.yaml",
-            "virtualservice_primary_ssh.yaml"),
+            "virtualservice_primary_ssh.yaml",
+            List.of(
+                "destinationrule_primary.yaml",
+                "destinationrule_primary_headless.yaml",
+                "destinationrule_primary_headless_pods.yaml")),
         Arguments.of(
             "../../gerritnetwork_replica_ssh.yaml",
             "gateway_replica_ssh.yaml",
-            "virtualservice_replica_ssh.yaml"),
+            "virtualservice_replica_ssh.yaml",
+            List.of(
+                "destinationrule_replica.yaml",
+                "destinationrule_replica_headless.yaml",
+                "destinationrule_replica_headless_pods.yaml")),
         Arguments.of(
             "../../gerritnetwork_primary_replica_ssh.yaml",
             "gateway_primary_replica_ssh.yaml",
-            "virtualservice_primary_replica_ssh.yaml"),
+            "virtualservice_primary_replica_ssh.yaml",
+            List.of(
+                "destinationrule_replica.yaml",
+                "destinationrule_replica_headless.yaml",
+                "destinationrule_replica_headless_pods.yaml")),
         Arguments.of(
             "../../gerritnetwork_receiver_replica_ssh.yaml",
             "gateway_receiver_replica_ssh.yaml",
-            "virtualservice_receiver_replica_ssh.yaml"));
+            "virtualservice_receiver_replica_ssh.yaml",
+            List.of(
+                "destinationrule_replica.yaml",
+                "destinationrule_replica_headless.yaml",
+                "destinationrule_replica_headless_pods.yaml")));
   }
 }
diff --git a/operator/src/test/resources/com/google/gerrit/k8s/operator/cluster/dependent/gerrit_maintenance.yaml b/operator/src/test/resources/com/google/gerrit/k8s/operator/cluster/dependent/gerrit_maintenance.yaml
index d0951f9..0453ee5 100644
--- a/operator/src/test/resources/com/google/gerrit/k8s/operator/cluster/dependent/gerrit_maintenance.yaml
+++ b/operator/src/test/resources/com/google/gerrit/k8s/operator/cluster/dependent/gerrit_maintenance.yaml
@@ -1,4 +1,4 @@
-apiVersion: "gerritoperator.google.com/v1beta16"
+apiVersion: "gerritoperator.google.com/v1beta17"
 kind: GerritMaintenance
 metadata:
   name: gerrit-gerrit-maintenance
diff --git a/operator/src/test/resources/com/google/gerrit/k8s/operator/cluster/dependent/gerrit_primary.yaml b/operator/src/test/resources/com/google/gerrit/k8s/operator/cluster/dependent/gerrit_primary.yaml
index 5f02651..1993a68 100644
--- a/operator/src/test/resources/com/google/gerrit/k8s/operator/cluster/dependent/gerrit_primary.yaml
+++ b/operator/src/test/resources/com/google/gerrit/k8s/operator/cluster/dependent/gerrit_primary.yaml
@@ -1,9 +1,9 @@
-apiVersion: gerritoperator.google.com/v1beta16
+apiVersion: gerritoperator.google.com/v1beta17
 kind: Gerrit
 metadata:
   name: gerrit
   annotations:
-    gerritoperator.google.com/apiVersion: gerritoperator.google.com/v1beta16
+    gerritoperator.google.com/apiVersion: gerritoperator.google.com/v1beta17
 spec:
   configFiles: {}
   containerImages:
diff --git a/operator/src/test/resources/com/google/gerrit/k8s/operator/cluster/dependent/gerrit_replica.yaml b/operator/src/test/resources/com/google/gerrit/k8s/operator/cluster/dependent/gerrit_replica.yaml
index e434ad1..7c867fb 100644
--- a/operator/src/test/resources/com/google/gerrit/k8s/operator/cluster/dependent/gerrit_replica.yaml
+++ b/operator/src/test/resources/com/google/gerrit/k8s/operator/cluster/dependent/gerrit_replica.yaml
@@ -1,9 +1,9 @@
-apiVersion: gerritoperator.google.com/v1beta16
+apiVersion: gerritoperator.google.com/v1beta17
 kind: Gerrit
 metadata:
   name: gerrit-replica
   annotations:
-    gerritoperator.google.com/apiVersion: gerritoperator.google.com/v1beta16
+    gerritoperator.google.com/apiVersion: gerritoperator.google.com/v1beta17
 spec:
   configFiles: {}
   containerImages:
diff --git a/operator/src/test/resources/com/google/gerrit/k8s/operator/cluster/gerritcluster_primary_replica.yaml b/operator/src/test/resources/com/google/gerrit/k8s/operator/cluster/gerritcluster_primary_replica.yaml
index cb916c0..24966c1 100644
--- a/operator/src/test/resources/com/google/gerrit/k8s/operator/cluster/gerritcluster_primary_replica.yaml
+++ b/operator/src/test/resources/com/google/gerrit/k8s/operator/cluster/gerritcluster_primary_replica.yaml
@@ -1,4 +1,4 @@
-apiVersion: "gerritoperator.google.com/v1beta16"
+apiVersion: "gerritoperator.google.com/v1beta17"
 kind: GerritCluster
 metadata:
   name: gerrit
diff --git a/operator/src/test/resources/com/google/gerrit/k8s/operator/gerrit/gerrit_es_primary.yaml b/operator/src/test/resources/com/google/gerrit/k8s/operator/gerrit/gerrit_es_primary.yaml
index 0a4c4cd..314ea3d 100644
--- a/operator/src/test/resources/com/google/gerrit/k8s/operator/gerrit/gerrit_es_primary.yaml
+++ b/operator/src/test/resources/com/google/gerrit/k8s/operator/gerrit/gerrit_es_primary.yaml
@@ -1,4 +1,4 @@
-apiVersion: "gerritoperator.google.com/v1beta16"
+apiVersion: "gerritoperator.google.com/v1beta17"
 kind: Gerrit
 metadata:
   name: gerrit
diff --git a/operator/src/test/resources/com/google/gerrit/k8s/operator/gerrit/gerrit_ha_primary.yaml b/operator/src/test/resources/com/google/gerrit/k8s/operator/gerrit/gerrit_ha_primary.yaml
index d6906f2..0b8ee24 100644
--- a/operator/src/test/resources/com/google/gerrit/k8s/operator/gerrit/gerrit_ha_primary.yaml
+++ b/operator/src/test/resources/com/google/gerrit/k8s/operator/gerrit/gerrit_ha_primary.yaml
@@ -1,4 +1,4 @@
-apiVersion: "gerritoperator.google.com/v1beta16"
+apiVersion: "gerritoperator.google.com/v1beta17"
 kind: Gerrit
 metadata:
   name: gerrit
diff --git a/operator/src/test/resources/com/google/gerrit/k8s/operator/gerrit/gerrit_single_primary.yaml b/operator/src/test/resources/com/google/gerrit/k8s/operator/gerrit/gerrit_single_primary.yaml
index 541258f..895ddd3 100644
--- a/operator/src/test/resources/com/google/gerrit/k8s/operator/gerrit/gerrit_single_primary.yaml
+++ b/operator/src/test/resources/com/google/gerrit/k8s/operator/gerrit/gerrit_single_primary.yaml
@@ -1,4 +1,4 @@
-apiVersion: "gerritoperator.google.com/v1beta16"
+apiVersion: "gerritoperator.google.com/v1beta17"
 kind: Gerrit
 metadata:
   name: gerrit
diff --git a/operator/src/test/resources/com/google/gerrit/k8s/operator/gitgc/dependent/cronjob_all_default.yaml b/operator/src/test/resources/com/google/gerrit/k8s/operator/gitgc/dependent/cronjob_all_default.yaml
index 5c0bdc3..c418a40 100644
--- a/operator/src/test/resources/com/google/gerrit/k8s/operator/gitgc/dependent/cronjob_all_default.yaml
+++ b/operator/src/test/resources/com/google/gerrit/k8s/operator/gitgc/dependent/cronjob_all_default.yaml
@@ -14,7 +14,7 @@
   annotations:
     app.kubernetes.io/managed-by: gerrit-operator
   ownerReferences:
-  - apiVersion: gerritoperator.google.com/v1beta16
+  - apiVersion: gerritoperator.google.com/v1beta17
     kind: GitGarbageCollection
     name: gitgc
     uid: abcd1234
diff --git a/operator/src/test/resources/com/google/gerrit/k8s/operator/gitgc/dependent/cronjob_all_nfs_workaround.yaml b/operator/src/test/resources/com/google/gerrit/k8s/operator/gitgc/dependent/cronjob_all_nfs_workaround.yaml
index fd1af7a..20c8d1e 100644
--- a/operator/src/test/resources/com/google/gerrit/k8s/operator/gitgc/dependent/cronjob_all_nfs_workaround.yaml
+++ b/operator/src/test/resources/com/google/gerrit/k8s/operator/gitgc/dependent/cronjob_all_nfs_workaround.yaml
@@ -14,7 +14,7 @@
   annotations:
     app.kubernetes.io/managed-by: gerrit-operator
   ownerReferences:
-  - apiVersion: gerritoperator.google.com/v1beta16
+  - apiVersion: gerritoperator.google.com/v1beta17
     kind: GitGarbageCollection
     name: gitgc
     uid: abcd1234
diff --git a/operator/src/test/resources/com/google/gerrit/k8s/operator/gitgc/dependent/cronjob_all_options_enabled.yaml b/operator/src/test/resources/com/google/gerrit/k8s/operator/gitgc/dependent/cronjob_all_options_enabled.yaml
index 1a55fc5..19d2835 100644
--- a/operator/src/test/resources/com/google/gerrit/k8s/operator/gitgc/dependent/cronjob_all_options_enabled.yaml
+++ b/operator/src/test/resources/com/google/gerrit/k8s/operator/gitgc/dependent/cronjob_all_options_enabled.yaml
@@ -14,7 +14,7 @@
   annotations:
     app.kubernetes.io/managed-by: gerrit-operator
   ownerReferences:
-  - apiVersion: gerritoperator.google.com/v1beta16
+  - apiVersion: gerritoperator.google.com/v1beta17
     kind: GitGarbageCollection
     name: gitgc
     uid: abcd1234
diff --git a/operator/src/test/resources/com/google/gerrit/k8s/operator/gitgc/dependent/cronjob_selected_default.yaml b/operator/src/test/resources/com/google/gerrit/k8s/operator/gitgc/dependent/cronjob_selected_default.yaml
index 1899e32..c03cf4e 100644
--- a/operator/src/test/resources/com/google/gerrit/k8s/operator/gitgc/dependent/cronjob_selected_default.yaml
+++ b/operator/src/test/resources/com/google/gerrit/k8s/operator/gitgc/dependent/cronjob_selected_default.yaml
@@ -14,7 +14,7 @@
   annotations:
     app.kubernetes.io/managed-by: gerrit-operator
   ownerReferences:
-  - apiVersion: gerritoperator.google.com/v1beta16
+  - apiVersion: gerritoperator.google.com/v1beta17
     kind: GitGarbageCollection
     name: gitgc
     uid: abcd1234
diff --git a/operator/src/test/resources/com/google/gerrit/k8s/operator/gitgc/dependent/cronjob_selected_options_enabled.yaml b/operator/src/test/resources/com/google/gerrit/k8s/operator/gitgc/dependent/cronjob_selected_options_enabled.yaml
index 0f4651c..8e3f3ca 100644
--- a/operator/src/test/resources/com/google/gerrit/k8s/operator/gitgc/dependent/cronjob_selected_options_enabled.yaml
+++ b/operator/src/test/resources/com/google/gerrit/k8s/operator/gitgc/dependent/cronjob_selected_options_enabled.yaml
@@ -14,7 +14,7 @@
   annotations:
     app.kubernetes.io/managed-by: gerrit-operator
   ownerReferences:
-  - apiVersion: gerritoperator.google.com/v1beta16
+  - apiVersion: gerritoperator.google.com/v1beta17
     kind: GitGarbageCollection
     name: gitgc
     uid: abcd1234
diff --git a/operator/src/test/resources/com/google/gerrit/k8s/operator/gitgc/gerritcluster_minimal.yaml b/operator/src/test/resources/com/google/gerrit/k8s/operator/gitgc/gerritcluster_minimal.yaml
index 075dbae..c07ec0b 100644
--- a/operator/src/test/resources/com/google/gerrit/k8s/operator/gitgc/gerritcluster_minimal.yaml
+++ b/operator/src/test/resources/com/google/gerrit/k8s/operator/gitgc/gerritcluster_minimal.yaml
@@ -1,4 +1,4 @@
-apiVersion: "gerritoperator.google.com/v1beta16"
+apiVersion: "gerritoperator.google.com/v1beta17"
 kind: GerritCluster
 metadata:
   name: gerrit
diff --git a/operator/src/test/resources/com/google/gerrit/k8s/operator/gitgc/gerritcluster_nfs_workaround.yaml b/operator/src/test/resources/com/google/gerrit/k8s/operator/gitgc/gerritcluster_nfs_workaround.yaml
index 986798c..d41cf7c 100644
--- a/operator/src/test/resources/com/google/gerrit/k8s/operator/gitgc/gerritcluster_nfs_workaround.yaml
+++ b/operator/src/test/resources/com/google/gerrit/k8s/operator/gitgc/gerritcluster_nfs_workaround.yaml
@@ -1,4 +1,4 @@
-apiVersion: "gerritoperator.google.com/v1beta16"
+apiVersion: "gerritoperator.google.com/v1beta17"
 kind: GerritCluster
 metadata:
   name: gerrit
diff --git a/operator/src/test/resources/com/google/gerrit/k8s/operator/gitgc/gitgc_all_default.yaml b/operator/src/test/resources/com/google/gerrit/k8s/operator/gitgc/gitgc_all_default.yaml
index 3d649a2..cd86d4d 100644
--- a/operator/src/test/resources/com/google/gerrit/k8s/operator/gitgc/gitgc_all_default.yaml
+++ b/operator/src/test/resources/com/google/gerrit/k8s/operator/gitgc/gitgc_all_default.yaml
@@ -1,4 +1,4 @@
-apiVersion: "gerritoperator.google.com/v1beta16"
+apiVersion: "gerritoperator.google.com/v1beta17"
 kind: GitGarbageCollection
 metadata:
   name: gitgc
diff --git a/operator/src/test/resources/com/google/gerrit/k8s/operator/gitgc/gitgc_all_options_enabled.yaml b/operator/src/test/resources/com/google/gerrit/k8s/operator/gitgc/gitgc_all_options_enabled.yaml
index 52aba5a..02f8d1b 100644
--- a/operator/src/test/resources/com/google/gerrit/k8s/operator/gitgc/gitgc_all_options_enabled.yaml
+++ b/operator/src/test/resources/com/google/gerrit/k8s/operator/gitgc/gitgc_all_options_enabled.yaml
@@ -1,4 +1,4 @@
-apiVersion: "gerritoperator.google.com/v1beta16"
+apiVersion: "gerritoperator.google.com/v1beta17"
 kind: GitGarbageCollection
 metadata:
   name: gitgc
diff --git a/operator/src/test/resources/com/google/gerrit/k8s/operator/gitgc/gitgc_selected_default.yaml b/operator/src/test/resources/com/google/gerrit/k8s/operator/gitgc/gitgc_selected_default.yaml
index f35f781..7db79d4 100644
--- a/operator/src/test/resources/com/google/gerrit/k8s/operator/gitgc/gitgc_selected_default.yaml
+++ b/operator/src/test/resources/com/google/gerrit/k8s/operator/gitgc/gitgc_selected_default.yaml
@@ -1,4 +1,4 @@
-apiVersion: "gerritoperator.google.com/v1beta16"
+apiVersion: "gerritoperator.google.com/v1beta17"
 kind: GitGarbageCollection
 metadata:
   name: gitgc
diff --git a/operator/src/test/resources/com/google/gerrit/k8s/operator/gitgc/gitgc_selected_options_enabled.yaml b/operator/src/test/resources/com/google/gerrit/k8s/operator/gitgc/gitgc_selected_options_enabled.yaml
index e7c0ee1..785e8b7 100644
--- a/operator/src/test/resources/com/google/gerrit/k8s/operator/gitgc/gitgc_selected_options_enabled.yaml
+++ b/operator/src/test/resources/com/google/gerrit/k8s/operator/gitgc/gitgc_selected_options_enabled.yaml
@@ -1,4 +1,4 @@
-apiVersion: "gerritoperator.google.com/v1beta16"
+apiVersion: "gerritoperator.google.com/v1beta17"
 kind: GitGarbageCollection
 metadata:
   name: gitgc
diff --git a/operator/src/test/resources/com/google/gerrit/k8s/operator/indexer/gerritcluster_es.yaml b/operator/src/test/resources/com/google/gerrit/k8s/operator/indexer/gerritcluster_es.yaml
index 97e5a30..6befbcc 100644
--- a/operator/src/test/resources/com/google/gerrit/k8s/operator/indexer/gerritcluster_es.yaml
+++ b/operator/src/test/resources/com/google/gerrit/k8s/operator/indexer/gerritcluster_es.yaml
@@ -1,4 +1,4 @@
-apiVersion: "gerritoperator.google.com/v1beta16"
+apiVersion: "gerritoperator.google.com/v1beta17"
 kind: GerritCluster
 metadata:
   name: gerrit
diff --git a/operator/src/test/resources/com/google/gerrit/k8s/operator/indexer/gerritcluster_minimal.yaml b/operator/src/test/resources/com/google/gerrit/k8s/operator/indexer/gerritcluster_minimal.yaml
index 01cdb9a..e9fd6ac 100644
--- a/operator/src/test/resources/com/google/gerrit/k8s/operator/indexer/gerritcluster_minimal.yaml
+++ b/operator/src/test/resources/com/google/gerrit/k8s/operator/indexer/gerritcluster_minimal.yaml
@@ -1,4 +1,4 @@
-apiVersion: "gerritoperator.google.com/v1beta16"
+apiVersion: "gerritoperator.google.com/v1beta17"
 kind: GerritCluster
 metadata:
   name: gerrit
diff --git a/operator/src/test/resources/com/google/gerrit/k8s/operator/indexer/indexer.yaml b/operator/src/test/resources/com/google/gerrit/k8s/operator/indexer/indexer.yaml
index 3837e45..318c4e2 100644
--- a/operator/src/test/resources/com/google/gerrit/k8s/operator/indexer/indexer.yaml
+++ b/operator/src/test/resources/com/google/gerrit/k8s/operator/indexer/indexer.yaml
@@ -1,4 +1,4 @@
-apiVersion: "gerritoperator.google.com/v1beta16"
+apiVersion: "gerritoperator.google.com/v1beta17"
 kind: GerritIndexer
 metadata:
   name: gerrit-indexer
diff --git a/operator/src/test/resources/com/google/gerrit/k8s/operator/indexer/indexer_es.yaml b/operator/src/test/resources/com/google/gerrit/k8s/operator/indexer/indexer_es.yaml
index 6f18b49..e7d6863 100644
--- a/operator/src/test/resources/com/google/gerrit/k8s/operator/indexer/indexer_es.yaml
+++ b/operator/src/test/resources/com/google/gerrit/k8s/operator/indexer/indexer_es.yaml
@@ -1,4 +1,4 @@
-apiVersion: "gerritoperator.google.com/v1beta16"
+apiVersion: "gerritoperator.google.com/v1beta17"
 kind: GerritIndexer
 metadata:
   name: gerrit-indexer
diff --git a/operator/src/test/resources/com/google/gerrit/k8s/operator/maintenance/gerrit-maintenance.yaml b/operator/src/test/resources/com/google/gerrit/k8s/operator/maintenance/gerrit-maintenance.yaml
index d0951f9..0453ee5 100644
--- a/operator/src/test/resources/com/google/gerrit/k8s/operator/maintenance/gerrit-maintenance.yaml
+++ b/operator/src/test/resources/com/google/gerrit/k8s/operator/maintenance/gerrit-maintenance.yaml
@@ -1,4 +1,4 @@
-apiVersion: "gerritoperator.google.com/v1beta16"
+apiVersion: "gerritoperator.google.com/v1beta17"
 kind: GerritMaintenance
 metadata:
   name: gerrit-gerrit-maintenance
diff --git a/operator/src/test/resources/com/google/gerrit/k8s/operator/network/gerritnetwork_primary.yaml b/operator/src/test/resources/com/google/gerrit/k8s/operator/network/gerritnetwork_primary.yaml
index 5581e5e..3e91bab 100644
--- a/operator/src/test/resources/com/google/gerrit/k8s/operator/network/gerritnetwork_primary.yaml
+++ b/operator/src/test/resources/com/google/gerrit/k8s/operator/network/gerritnetwork_primary.yaml
@@ -1,4 +1,4 @@
-apiVersion: "gerritoperator.google.com/v1beta16"
+apiVersion: "gerritoperator.google.com/v1beta17"
 kind: GerritNetwork
 metadata:
   name: gerrit
@@ -11,6 +11,8 @@
       enabled: false
     ambassador:
       id: ["my-id-1", "my-id-2"]
+    istio:
+      mTLS: true
   primaryGerrit:
     name: primary
     httpPort: 48080
diff --git a/operator/src/test/resources/com/google/gerrit/k8s/operator/network/gerritnetwork_primary_replica.yaml b/operator/src/test/resources/com/google/gerrit/k8s/operator/network/gerritnetwork_primary_replica.yaml
index 45e7e61..e66c8ff 100644
--- a/operator/src/test/resources/com/google/gerrit/k8s/operator/network/gerritnetwork_primary_replica.yaml
+++ b/operator/src/test/resources/com/google/gerrit/k8s/operator/network/gerritnetwork_primary_replica.yaml
@@ -1,4 +1,4 @@
-apiVersion: "gerritoperator.google.com/v1beta16"
+apiVersion: "gerritoperator.google.com/v1beta17"
 kind: GerritNetwork
 metadata:
   name: gerrit
@@ -11,6 +11,8 @@
       enabled: false
     ambassador:
       id: ["my-id-1", "my-id-2"]
+    istio:
+      mTLS: true
   primaryGerrit:
     name: primary
     httpPort: 48080
diff --git a/operator/src/test/resources/com/google/gerrit/k8s/operator/network/gerritnetwork_primary_replica_ssh.yaml b/operator/src/test/resources/com/google/gerrit/k8s/operator/network/gerritnetwork_primary_replica_ssh.yaml
index 50fd437..bfe4d7b 100644
--- a/operator/src/test/resources/com/google/gerrit/k8s/operator/network/gerritnetwork_primary_replica_ssh.yaml
+++ b/operator/src/test/resources/com/google/gerrit/k8s/operator/network/gerritnetwork_primary_replica_ssh.yaml
@@ -1,4 +1,4 @@
-apiVersion: "gerritoperator.google.com/v1beta16"
+apiVersion: "gerritoperator.google.com/v1beta17"
 kind: GerritNetwork
 metadata:
   name: gerrit
@@ -11,6 +11,8 @@
       enabled: false
     ssh:
       enabled: true
+    istio:
+      mTLS: true
   primaryGerrit:
     name: primary
     httpPort: 48080
diff --git a/operator/src/test/resources/com/google/gerrit/k8s/operator/network/gerritnetwork_primary_replica_tls.yaml b/operator/src/test/resources/com/google/gerrit/k8s/operator/network/gerritnetwork_primary_replica_tls.yaml
index 963be49..b08c798 100644
--- a/operator/src/test/resources/com/google/gerrit/k8s/operator/network/gerritnetwork_primary_replica_tls.yaml
+++ b/operator/src/test/resources/com/google/gerrit/k8s/operator/network/gerritnetwork_primary_replica_tls.yaml
@@ -1,4 +1,4 @@
-apiVersion: "gerritoperator.google.com/v1beta16"
+apiVersion: "gerritoperator.google.com/v1beta17"
 kind: GerritNetwork
 metadata:
   name: gerrit
@@ -12,6 +12,8 @@
       secret: tls-secret
     ambassador:
       id: ["my-id-1", "my-id-2"]
+    istio:
+      mTLS: true
   primaryGerrit:
     name: primary
     httpPort: 48080
diff --git a/operator/src/test/resources/com/google/gerrit/k8s/operator/network/gerritnetwork_primary_ssh.yaml b/operator/src/test/resources/com/google/gerrit/k8s/operator/network/gerritnetwork_primary_ssh.yaml
index c3be283..cd987ea 100644
--- a/operator/src/test/resources/com/google/gerrit/k8s/operator/network/gerritnetwork_primary_ssh.yaml
+++ b/operator/src/test/resources/com/google/gerrit/k8s/operator/network/gerritnetwork_primary_ssh.yaml
@@ -1,4 +1,4 @@
-apiVersion: "gerritoperator.google.com/v1beta16"
+apiVersion: "gerritoperator.google.com/v1beta17"
 kind: GerritNetwork
 metadata:
   name: gerrit
@@ -11,6 +11,8 @@
       enabled: false
     ssh:
       enabled: true
+    istio:
+      mTLS: true
   primaryGerrit:
     name: primary
     httpPort: 48080
diff --git a/operator/src/test/resources/com/google/gerrit/k8s/operator/network/gerritnetwork_receiver_replica.yaml b/operator/src/test/resources/com/google/gerrit/k8s/operator/network/gerritnetwork_receiver_replica.yaml
index 69ed3e9..84e3e93 100644
--- a/operator/src/test/resources/com/google/gerrit/k8s/operator/network/gerritnetwork_receiver_replica.yaml
+++ b/operator/src/test/resources/com/google/gerrit/k8s/operator/network/gerritnetwork_receiver_replica.yaml
@@ -1,4 +1,4 @@
-apiVersion: "gerritoperator.google.com/v1beta16"
+apiVersion: "gerritoperator.google.com/v1beta17"
 kind: GerritNetwork
 metadata:
   name: gerrit
@@ -11,6 +11,8 @@
       enabled: false
     ambassador:
       id: ["my-id-1", "my-id-2"]
+    istio:
+      mTLS: true
   gerritReplica:
     name: replica
     httpPort: 48080
diff --git a/operator/src/test/resources/com/google/gerrit/k8s/operator/network/gerritnetwork_receiver_replica_ssh.yaml b/operator/src/test/resources/com/google/gerrit/k8s/operator/network/gerritnetwork_receiver_replica_ssh.yaml
index 7b84fda..5b44bc5 100644
--- a/operator/src/test/resources/com/google/gerrit/k8s/operator/network/gerritnetwork_receiver_replica_ssh.yaml
+++ b/operator/src/test/resources/com/google/gerrit/k8s/operator/network/gerritnetwork_receiver_replica_ssh.yaml
@@ -1,4 +1,4 @@
-apiVersion: "gerritoperator.google.com/v1beta16"
+apiVersion: "gerritoperator.google.com/v1beta17"
 kind: GerritNetwork
 metadata:
   name: gerrit
@@ -11,6 +11,8 @@
       enabled: false
     ssh:
       enabled: true
+    istio:
+      mTLS: true
   gerritReplica:
     name: replica
     httpPort: 48080
diff --git a/operator/src/test/resources/com/google/gerrit/k8s/operator/network/gerritnetwork_receiver_replica_tls.yaml b/operator/src/test/resources/com/google/gerrit/k8s/operator/network/gerritnetwork_receiver_replica_tls.yaml
index 8a12110..2b049b5 100644
--- a/operator/src/test/resources/com/google/gerrit/k8s/operator/network/gerritnetwork_receiver_replica_tls.yaml
+++ b/operator/src/test/resources/com/google/gerrit/k8s/operator/network/gerritnetwork_receiver_replica_tls.yaml
@@ -1,4 +1,4 @@
-apiVersion: "gerritoperator.google.com/v1beta16"
+apiVersion: "gerritoperator.google.com/v1beta17"
 kind: GerritNetwork
 metadata:
   name: gerrit
@@ -12,6 +12,8 @@
       secret: tls-secret
     ambassador:
       id: ["my-id-1", "my-id-2"]
+    istio:
+      mTLS: true
   gerritReplica:
     name: replica
     httpPort: 48080
diff --git a/operator/src/test/resources/com/google/gerrit/k8s/operator/network/gerritnetwork_replica.yaml b/operator/src/test/resources/com/google/gerrit/k8s/operator/network/gerritnetwork_replica.yaml
index a6bde98..bebdbe8 100644
--- a/operator/src/test/resources/com/google/gerrit/k8s/operator/network/gerritnetwork_replica.yaml
+++ b/operator/src/test/resources/com/google/gerrit/k8s/operator/network/gerritnetwork_replica.yaml
@@ -1,4 +1,4 @@
-apiVersion: "gerritoperator.google.com/v1beta16"
+apiVersion: "gerritoperator.google.com/v1beta17"
 kind: GerritNetwork
 metadata:
   name: gerrit
@@ -11,6 +11,8 @@
       enabled: false
     ambassador:
       id: ["my-id-1", "my-id-2"]
+    istio:
+      mTLS: true
   gerritReplica:
     name: replica
     httpPort: 48080
diff --git a/operator/src/test/resources/com/google/gerrit/k8s/operator/network/gerritnetwork_replica_ssh.yaml b/operator/src/test/resources/com/google/gerrit/k8s/operator/network/gerritnetwork_replica_ssh.yaml
index bbf946a..d6a89c4 100644
--- a/operator/src/test/resources/com/google/gerrit/k8s/operator/network/gerritnetwork_replica_ssh.yaml
+++ b/operator/src/test/resources/com/google/gerrit/k8s/operator/network/gerritnetwork_replica_ssh.yaml
@@ -1,4 +1,4 @@
-apiVersion: "gerritoperator.google.com/v1beta16"
+apiVersion: "gerritoperator.google.com/v1beta17"
 kind: GerritNetwork
 metadata:
   name: gerrit
@@ -11,6 +11,8 @@
       enabled: false
     ssh:
       enabled: true
+    istio:
+      mTLS: true
   gerritReplica:
     name: replica
     httpPort: 48080
diff --git a/operator/src/test/resources/com/google/gerrit/k8s/operator/network/istio/dependent/destinationrule_primary.yaml b/operator/src/test/resources/com/google/gerrit/k8s/operator/network/istio/dependent/destinationrule_primary.yaml
new file mode 100644
index 0000000..6b7f332
--- /dev/null
+++ b/operator/src/test/resources/com/google/gerrit/k8s/operator/network/istio/dependent/destinationrule_primary.yaml
@@ -0,0 +1,11 @@
+apiVersion: networking.istio.io/v1
+kind: DestinationRule
+metadata:
+  name: primary
+  namespace: gerrit
+spec:
+  host: primary-service.gerrit.svc.cluster.local
+  trafficPolicy:
+    loadBalancer:
+      consistentHash:
+        useSourceIp: true
diff --git a/operator/src/test/resources/com/google/gerrit/k8s/operator/network/istio/dependent/destinationrule_primary_headless.yaml b/operator/src/test/resources/com/google/gerrit/k8s/operator/network/istio/dependent/destinationrule_primary_headless.yaml
new file mode 100644
index 0000000..27330bc
--- /dev/null
+++ b/operator/src/test/resources/com/google/gerrit/k8s/operator/network/istio/dependent/destinationrule_primary_headless.yaml
@@ -0,0 +1,13 @@
+apiVersion: networking.istio.io/v1
+kind: DestinationRule
+metadata:
+  name: primary-headless-service
+  namespace: gerrit
+spec:
+  host: primary.gerrit.svc.cluster.local
+  trafficPolicy:
+    loadBalancer:
+      consistentHash:
+        useSourceIp: true
+    tls:
+      mode: ISTIO_MUTUAL
diff --git a/operator/src/test/resources/com/google/gerrit/k8s/operator/network/istio/dependent/destinationrule_primary_headless_pods.yaml b/operator/src/test/resources/com/google/gerrit/k8s/operator/network/istio/dependent/destinationrule_primary_headless_pods.yaml
new file mode 100644
index 0000000..f2ecd7c
--- /dev/null
+++ b/operator/src/test/resources/com/google/gerrit/k8s/operator/network/istio/dependent/destinationrule_primary_headless_pods.yaml
@@ -0,0 +1,10 @@
+apiVersion: networking.istio.io/v1
+kind: DestinationRule
+metadata:
+  name: primary-headless-pods
+  namespace: gerrit
+spec:
+  host: '*.primary.gerrit.svc.cluster.local'
+  trafficPolicy:
+    tls:
+      mode: ISTIO_MUTUAL
diff --git a/operator/src/test/resources/com/google/gerrit/k8s/operator/network/istio/dependent/destinationrule_replica.yaml b/operator/src/test/resources/com/google/gerrit/k8s/operator/network/istio/dependent/destinationrule_replica.yaml
new file mode 100644
index 0000000..812b1a8
--- /dev/null
+++ b/operator/src/test/resources/com/google/gerrit/k8s/operator/network/istio/dependent/destinationrule_replica.yaml
@@ -0,0 +1,10 @@
+apiVersion: networking.istio.io/v1
+kind: DestinationRule
+metadata:
+  name: replica
+  namespace: gerrit
+spec:
+  host: replica-service.gerrit.svc.cluster.local
+  trafficPolicy:
+    loadBalancer:
+      simple: LEAST_CONN
diff --git a/operator/src/test/resources/com/google/gerrit/k8s/operator/network/istio/dependent/destinationrule_replica_headless.yaml b/operator/src/test/resources/com/google/gerrit/k8s/operator/network/istio/dependent/destinationrule_replica_headless.yaml
new file mode 100644
index 0000000..823d2d3
--- /dev/null
+++ b/operator/src/test/resources/com/google/gerrit/k8s/operator/network/istio/dependent/destinationrule_replica_headless.yaml
@@ -0,0 +1,12 @@
+apiVersion: networking.istio.io/v1
+kind: DestinationRule
+metadata:
+  name: replica-headless-service
+  namespace: gerrit
+spec:
+  host: replica.gerrit.svc.cluster.local
+  trafficPolicy:
+    loadBalancer:
+      simple: LEAST_CONN
+    tls:
+      mode: ISTIO_MUTUAL
diff --git a/operator/src/test/resources/com/google/gerrit/k8s/operator/network/istio/dependent/destinationrule_replica_headless_pods.yaml b/operator/src/test/resources/com/google/gerrit/k8s/operator/network/istio/dependent/destinationrule_replica_headless_pods.yaml
new file mode 100644
index 0000000..3be0b9c
--- /dev/null
+++ b/operator/src/test/resources/com/google/gerrit/k8s/operator/network/istio/dependent/destinationrule_replica_headless_pods.yaml
@@ -0,0 +1,10 @@
+apiVersion: networking.istio.io/v1
+kind: DestinationRule
+metadata:
+  name: replica-headless-pods
+  namespace: gerrit
+spec:
+  host: '*.replica.gerrit.svc.cluster.local'
+  trafficPolicy:
+    tls:
+      mode: ISTIO_MUTUAL
diff --git a/operator/src/test/resources/com/google/gerrit/k8s/operator/receiver/receiver.yaml b/operator/src/test/resources/com/google/gerrit/k8s/operator/receiver/receiver.yaml
index 409e5b1..30e7c46 100644
--- a/operator/src/test/resources/com/google/gerrit/k8s/operator/receiver/receiver.yaml
+++ b/operator/src/test/resources/com/google/gerrit/k8s/operator/receiver/receiver.yaml
@@ -1,4 +1,4 @@
-apiVersion: "gerritoperator.google.com/v1beta16"
+apiVersion: "gerritoperator.google.com/v1beta17"
 kind: Receiver
 metadata:
   name: receiver
diff --git a/operator/src/test/resources/com/google/gerrit/k8s/operator/receiver/receiver_minimal.yaml b/operator/src/test/resources/com/google/gerrit/k8s/operator/receiver/receiver_minimal.yaml
index b96ed29..022a933 100644
--- a/operator/src/test/resources/com/google/gerrit/k8s/operator/receiver/receiver_minimal.yaml
+++ b/operator/src/test/resources/com/google/gerrit/k8s/operator/receiver/receiver_minimal.yaml
@@ -1,4 +1,4 @@
-apiVersion: "gerritoperator.google.com/v1beta16"
+apiVersion: "gerritoperator.google.com/v1beta17"
 kind: Receiver
 metadata:
   name: receiver
diff --git a/operator/src/test/resources/com/google/gerrit/k8s/operator/tasks/incomingrepl/gerritcluster_incomingrepl.yaml b/operator/src/test/resources/com/google/gerrit/k8s/operator/tasks/incomingrepl/gerritcluster_incomingrepl.yaml
index 068ac6b..1c1fa16 100644
--- a/operator/src/test/resources/com/google/gerrit/k8s/operator/tasks/incomingrepl/gerritcluster_incomingrepl.yaml
+++ b/operator/src/test/resources/com/google/gerrit/k8s/operator/tasks/incomingrepl/gerritcluster_incomingrepl.yaml
@@ -1,4 +1,4 @@
-apiVersion: "gerritoperator.google.com/v1beta16"
+apiVersion: "gerritoperator.google.com/v1beta17"
 kind: GerritCluster
 metadata:
   name: gerrit
diff --git a/operator/src/test/resources/com/google/gerrit/k8s/operator/tasks/incomingrepl/incomingrepltask.yaml b/operator/src/test/resources/com/google/gerrit/k8s/operator/tasks/incomingrepl/incomingrepltask.yaml
index 24147a4..8a7dd07 100644
--- a/operator/src/test/resources/com/google/gerrit/k8s/operator/tasks/incomingrepl/incomingrepltask.yaml
+++ b/operator/src/test/resources/com/google/gerrit/k8s/operator/tasks/incomingrepl/incomingrepltask.yaml
@@ -1,4 +1,4 @@
-apiVersion: "gerritoperator.google.com/v1beta16"
+apiVersion: "gerritoperator.google.com/v1beta17"
 kind: IncomingReplicationTask
 metadata:
   name: incoming-replication-test