},
		},
		{
			name:       "MeshConfig registry only, Sidecar with registry only",
			meshConfig: meshConfigWithRegistryOnly,
			sidecar:    configRegistryOnly,
			outboundTrafficPolicy: &networking.OutboundTrafficPolicy{
				Mode: networking.OutboundTrafficPolicy_REGISTRY_ONLY,
			},
		},
		{
			name:       "MeshConfig registry only, Sidecar with allow any",
			meshConfig: meshConfigWithRegistryOnly,

				virtualServiceWithNestedWildcardHost,
				virtualServiceWithGoogleWildcardHost,
			},
			Services: []*model.Service{exampleWildcardService, exampleNestedWildcardService},
		})

		// Redefine the service registry for this test
		serviceRegistry := map[host.Name]*model.Service{
			"*.example.org":             exampleWildcardService,
			"goodbye.hello.example.org": exampleNestedWildcardService,
		}

  // +optional
  // +patchMergeKey=uid
  // +patchStrategy=merge
  repeated OwnerReference ownerReferences = 13;

  // Must be empty before the object is deleted from the registry. Each entry
  // is an identifier for the responsible component that will remove the entry
  // from the list. If the deletionTimestamp of the object is non-nil, entries
  // in this list can only be removed.

			want:  nil,
		},
		{
			name:  "proxy with IP not in the registry",
			proxy: &model.Proxy{Metadata: &model.NodeMetadata{}, IPAddresses: []string{"1.1.1.1"}},
			want:  nil,
		},
		{
			name:  "proxy with IP from the registry, 1 matching WE, but no matching Service",
			proxy: &model.Proxy{Metadata: &model.NodeMetadata{}, IPAddresses: []string{"4.4.4.41"}},

	go kc.Run(stop)
	go se.Run(stop)

	return configController, client.Kube(), xdsUpdater
}

// TestWorkloadInstances is effectively an integration test of composing the Kubernetes service registry with the
// external service registry, which have cross-references by workload instances.
func TestWorkloadInstances(t *testing.T) {
	istiotest.SetForTest(t, &features.WorkloadEntryHealthChecks, true)
	port := &networking.ServicePort{

// XDSUpdater is used for direct updates of the xDS model and incremental push.
// Pilot uses multiple registries - for example each K8S cluster is a registry
// instance. Each registry is responsible for tracking a set
// of endpoints associated with mesh services, and calling the EDSUpdate on changes.
// A registry may group endpoints for a service in smaller subsets - for example by

  // to use for pulling any images in pods that reference this ServiceAccount.
  // Must be set for any cluster configured with private docker registry.
  repeated string imagePullSecrets = 37;

  // Specifies the default namespace for the Istio control plane components.
  string istioNamespace = 14;

	// Stores VS hosts that don't correspond to services in the registry
	// Currently, the only use for this list is to enable VirtualService configuration to affect
	// traffic to hosts outside of the service registry (e.g. google.com) on port 80
	nonServiceRegistryHosts := make([]string, 0)
	// Stores services for this VirtualService that are in the registry (based on hostname)
	matchingRegistryServices := make([]*model.Service, 0)

					"*": true,
				},
			},
			registryOnly: true,
		},
		{
			name:                  "no sidecar config with virtual services with no service in registry",
			routeName:             "80", // no service for the host in registry; use port 80 by default
			sidecarConfig:         nil,
			virtualServiceConfigs: []*config.Config{&virtualService3},
			expectedHosts: map[string]map[string]bool{

	}
	allocateAndValidate()
}

func TestWorkloadEntryOnlyMode(t *testing.T) {
	store, registry, _ := initServiceDiscoveryWithOpts(t, true)
	createConfigs([]*config.Config{httpStatic}, store, t)
	svcs := registry.Services()
	if len(svcs) > 0 {
		t.Fatalf("expected 0 services, got %d", len(svcs))
	}
	svc := registry.GetService("*.google.com")
	if svc != nil {
		t.Fatalf("expected nil, got %v", svc)
	}
}