}

// describePeerAuthentication fetches all PeerAuthentication in workload and root namespace.
// It lists the ones applied to the pod, and the current active mTLS mode.
// When the client doesn't have access to root namespace, it will only show workload namespace Peerauthentications.
func describePeerAuthentication(
	writer io.Writer,
	kubeClient kube.CLIClient,

// or the full list of endpoints for a service across registries, since it limits
// scalability.
//
// Future optimizations will include grouping the endpoints by labels, gateway or region to
// reduce the time when subsetting or split-horizon is used. This design assumes pilot
// tracks all endpoints in the mesh and they fit in RAM - so limit is few M endpoints.
// It is possible to split the endpoint tracking in future.

  // Specifies the global logging level settings for the Istio control plane components.
  GlobalLoggingConfig logging = 17;

  // The Mesh Identifier. It should be unique within the scope where
  // meshes will interact with each other, but it is not required to be
  // globally/universally unique. For example, if any of the following are true,
  // then two meshes must have different Mesh IDs:

	//
	// Even if a user explicitly created a Sidecar config with an ingress listener for a privileged port,
	// it is still not worth it creating such a listener if we already known that a proxy will end up
	// rejecting it.
	testPrivilegedPorts(t, func(t *testing.T, proxy *model.Proxy, port uint32) []*listener.Listener {

				{
					Hostname: "bookinginfo.com",
					Ports:    port9999,
				},
				{
					Hostname: "private.com",
				},
			},
			nil,
		},
		// Validates when service is scoped to Sidecar, it uses service port rather than listener port.
		{
			"service-port-used-while-cloning",
			configs8,
			services9,
			nil,
			[]*Service{
				{
					Hostname: "foo.svc.cluster.local",

		// to the list of non-serviceregistry hosts
		foundSvcMatch := false
		for svcHost, svc := range serviceRegistry {
			// First, check if this service matches the VS host.
			// If it does, then we never want to add it to the nonServiceRegistryHosts list.
			// The result is OR'd so we don't overwrite a previously true value
			// localMatch is tracking the match found within this iteration of the loop

	// In STRICT mode, only endpoints that meets all of the routing preferences will be considered.
	// This can be used, for instance, to keep traffic ONLY within the same cluster/node/region.
	// This should be used with caution, as it can result in all traffic being dropped if there is no matching endpoints,
	// even if there are endpoints outside of the preferences.
	LoadBalancing_STRICT LoadBalancing_Mode = 1

		if features.HTTP10 {
			// If HTTP 1.0 is enabled, we will match it
			return []string{"http/1.0", "http/1.1", "h2c"}
		}
		// Otherwise, matching would just lead to immediate rejection. By not matching, we can let it pass
		// through as raw TCP at least.
		// NOTE: mtlsHTTPALPNs can always include 1.0, for simplicity, as it will only be sent if a client
		return []string{"http/1.1", "h2c"}
	}()

						if from.Config().HasSidecar() && !opts.To.Config().HasProxyCapabilities() {
							// Sidecar respects it
							return false
						}
						if from.Config().HasAnyWaypointProxy() && !opts.To.Config().HasProxyCapabilities() {
							// Waypoint respects it
							return false
						}
						return true
					},
					ExpectMTLS: mtlsOnExpect,
				},
				{

	"istio.io/istio/pkg/test"
	"istio.io/istio/pkg/test/util/assert"
	"istio.io/istio/pkg/test/util/retry"
	"istio.io/istio/pkg/util/sets"
)

const (
	testService = "test"
)

// eventually polls cond until it completes (returns true) or times out (resulting in a test failure).
func eventually(t test.Failer, cond func() bool) {
	t.Helper()
	retry.UntilSuccessOrFail(t, func() error {
		if !cond() {