可以在路由规则中使用标签来统一配置 TLS 选项，避免在每个路由上设置。

示例代码：

apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: mygateway
spec:
  selector:
    istio: ingressgateway
  servers:
  - port:
      number: 443
      name: https
      protocol: HTTPS
    tls:
      mode: SIMPLE
      serverCertificate: /etc/certs/server.pem
      privateKey: /etc/certs/privatekey.pem
    hosts:
    - example.com
---
apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
  name: mydestinationrule
spec:
  host: myservice
  trafficPolicy:
    tls:
      mode: ISTIO_MUTUAL
      # Other TLS options can be set here

---
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: myvirtualservice
spec:
  hosts:
  - example.com
  gateways:
  - mygateway
  http:
  - match:
    - uri:
        prefix: /api
    route:
    - destination:
        host: myservice
        port:
          number: 80
        subset: v2
    tls:
      # Apply TLS to all routes in this HTTP rule
      mode: MUTUAL
      clientCertificate: /etc/certs/client.pem
      privateKey: /etc/certs/privatekey.pem
  - route:
    - destination:
        host: myservice
        port:
          number: 80
        subset: v1
    tls:
      # Apply TLS only to this route in the HTTP rule
      mode: MUTUAL
      clientCertificate: /etc/certs/client.pem
      privateKey: /etc/certs/privatekey.pem

在上面的示例代码中，我们定义了一个 Gateway、一个 DestinationRule 和一个 VirtualService。在 tls 部分，我们在 Gateway 中设置了 TLS 选项。在 DestinationRule 和 VirtualService 中，我们使用路由匹配来定义如何路由到后端服务，并