ClusterID: c.Cluster(),
		},
		tlsMode:  model.GetTLSModeFromEndpointLabels(proxy.Labels),
		nodeName: proxy.GetNodeName(),
	}
	var networkID network.ID
	if len(proxy.IPAddresses) > 0 {
		networkID = out.endpointNetwork(proxy.IPAddresses[0])
	}
	out.labels = labelutil.AugmentLabels(proxy.Labels, c.Cluster(), locality, out.nodeName, networkID)
	return out
}

func (b *EndpointBuilder) buildIstioEndpoint(

			PurgeInterval:         wasmPurgeInterval,
			HTTPRequestTimeout:    wasmHTTPRequestTimeout,
			HTTPRequestMaxRetries: wasmHTTPRequestMaxRetries,
		},
		ProxyIPAddresses:            proxy.IPAddresses,
		ServiceNode:                 proxy.ServiceNode(),
		EnvoyStatusPort:             envoyStatusPortEnv,
		EnvoyPrometheusPort:         envoyPrometheusPortEnv,
		MinimumDrainDuration:        minimumDrainDurationEnv,

		// graduated to GA:
		//
		// TODO (https://github.com/kubernetes/kubernetes/issues/108451): remove the override in 1.25.
		// apisstorage.Resource("csistoragecapacities").WithVersion("v1beta1"),
		networking.Resource("ipaddresses").WithVersion("v1alpha1"),
		networking.Resource("servicecidrs").WithVersion("v1alpha1"),
		certificates.Resource("clustertrustbundles").WithVersion("v1alpha1"),

	}

	return apiEndpoints
}

// isHostIP - helper for validating if the provided arg is an ip address.
func isHostIP(ipAddress string) bool {
	host, _, err := net.SplitHostPort(ipAddress)
	if err != nil {
		host = ipAddress
	}
	// Strip off IPv6 zone information.
	if i := strings.Index(host, "%"); i > -1 {
		host = host[:i]
	}
	return net.ParseIP(host) != nil
}

	}

	subs := sets.New(w.ResourceNames...)
	var addresses sets.String
	if isReq {
		// this is from request, we only send response for the subscribed address
		// At t0, a client request A, we only send A and additional resources back to the client.
		// At t1, a client request B, we only send B and additional resources back to the client, no A here.
		addresses = req.Delta.Subscribed
	} else {
		if w.Wildcard {

func TestAddressesToHostnamesAndIPs(t *testing.T) {
	tests := []struct {
		name         string
		addresses    []v1.NodeAddress
		wantDNSNames []string
		wantIPs      []net.IP
	}{
		{
			name:         "empty",
			addresses:    nil,
			wantDNSNames: nil,
			wantIPs:      nil,
		},
		{
			name:         "ignore empty values",
			addresses:    []v1.NodeAddress{{Type: v1.NodeHostName, Address: ""}},
			wantDNSNames: nil,

			Source:        kind.ServiceEntry,
			Waypoint:      waypointKey,
		}
	})
}

func (a *index) constructServiceEntries(svc *networkingclient.ServiceEntry, w *Waypoint) []*workloadapi.Service {
	addresses, err := slices.MapErr(svc.Spec.Addresses, a.toNetworkAddressFromCidr)
	if err != nil {
		// TODO: perhaps we should support CIDR in the future?
		return nil
	}
	ports := make([]*workloadapi.Port, 0, len(svc.Spec.Ports))

			inputs: []any{},
			se: &networkingclient.ServiceEntry{
				ObjectMeta: metav1.ObjectMeta{
					Name:      "name",
					Namespace: "ns",
				},
				Spec: networking.ServiceEntry{
					Addresses: []string{"1.2.3.4"},
					Hosts:     []string{"a.example.com", "b.example.com"},
					Ports: []*networking.ServicePort{{
						Number: 80,
						Name:   "http",
					}},
					SubjectAltNames: []string{"san1"},

	// Some operating systems provide no support for mapping IPv4
	// addresses to IPv6, and a runtime check is unnecessary.
	switch runtime.GOOS {
	case "dragonfly", "openbsd":
		return false
	}

	ipStackCaps.Once.Do(ipStackCaps.probe)
	return ipStackCaps.ipv4MappedIPv6Enabled
}

// An addrList represents a list of network endpoint addresses.
type addrList []Addr

// isIPv4 reports whether addr contains an IPv4 address.

		return preferDB
	}

	// Rule 3: Avoid deprecated addresses.
	// If Source(DA) is deprecated and Source(DB) is not, then prefer DB.
	// Similarly, if Source(DA) is not deprecated and Source(DB) is
	// deprecated, then prefer DA.

	// TODO(bradfitz): implement? low priority for now.

	// Rule 4: Prefer home addresses.
	// If Source(DA) is simultaneously a home address and care-of address