"foo.com",
			&model.Proxy{Metadata: &model.NodeMetadata{}},
			false, false, model.MTLSUnknown,
			tlsSettings,
			userSupplied,
		},
		{
			"Metadata cert path override ISTIO_MUTUAL",
			tlsSettings,
			[]string{"custom.foo.com"},
			"custom.foo.com",
			&model.Proxy{Metadata: &model.NodeMetadata{
				TLSClientCertChain: "/custom/chain.pem",

		want  []model.ServiceTarget
	}{
		{
			name:  "proxy with unspecified IP",
			proxy: &model.Proxy{Metadata: &model.NodeMetadata{}, IPAddresses: nil},
			want:  nil,
		},
		{
			name:  "proxy with IP not in the registry",
			proxy: &model.Proxy{Metadata: &model.NodeMetadata{}, IPAddresses: []string{"1.1.1.1"}},
			want:  nil,
		},
		{

				Metadata:        &NodeMetadata{IstioVersion: "1.4.0", Labels: map[string]string{"app": "v1"}},
				ConfigNamespace: "test-ns",
			},
			expectedListenerPatches: 2,
			expectedClusterPatches:  2,
		},
		{
			name: "proxy in root namespace matches an envoyfilter",
			proxy: &Proxy{
				Labels:          map[string]string{"app": "v1"},

			assert.Equal(t, tt.excepted, got)
		})
	}
}

func TestAccessLoggingCache(t *testing.T) {
	sidecar := &Proxy{ConfigNamespace: "default", Metadata: &NodeMetadata{Labels: map[string]string{"app": "test"}}}
	otherNamespace := &Proxy{ConfigNamespace: "common", Metadata: &NodeMetadata{Labels: map[string]string{"app": "test"}}}
	cfgs := &tpb.Telemetry{
		AccessLogging: []*tpb.AccessLogging{
			{
				Providers: []*tpb.ProviderRef{
					{

		DNSDomain:   "default.example.org",
		Metadata: &model.NodeMetadata{
			Namespace: "not-default",
		},
		ConfigNamespace: "not-default",
	}
	pr.DiscoverIPMode()
	return pr
}

func getIPv6Proxy() *model.Proxy {
	pr := &model.Proxy{
		Type:        model.SidecarProxy,
		IPAddresses: []string{"2001:1::1"},
		Metadata: &model.NodeMetadata{
			Namespace: "not-default",
		},
		ConfigNamespace: "not-default",

	for _, ambient := range []bool{false, true} {
		name := "disabled"
		if ambient {
			name = "enabled"
		}
		m := mesh.DefaultMeshConfig()
		var nodeMeta *model.NodeMetadata
		if ambient {
			nodeMeta = &model.NodeMetadata{EnableHBONE: true}
			pod = pod.DeepCopy()
			pod.Annotations[constants.AmbientRedirection] = constants.AmbientRedirectionEnabled
		}
		opts := xds.FakeOptions{MeshConfig: m}

		ConfigNamespace: "not-default",
		Metadata: &model.NodeMetadata{
			IstioVersion: "1.2.2",
			Raw: map[string]any{
				"foo": "sidecar",
				"bar": "proxy",
			},
		},
	}

	gatewayProxy := &model.Proxy{
		Type:            model.Router,
		ConfigNamespace: "not-default",
		Metadata: &model.NodeMetadata{
			IstioVersion: "1.2.2",
			Raw: map[string]any{

				EndpointPort:    uint32(targetPort),
			},
		})
	}
	return ret
}

func TestInboundClusters(t *testing.T) {
	proxy := &model.Proxy{
		IPAddresses: []string{"1.2.3.4"},
		Metadata:    &model.NodeMetadata{},
	}
	service := &model.Service{
		Hostname:       host.Name("backend.default.svc.cluster.local"),
		DefaultAddress: "1.1.1.1",
		Ports: model.PortList{&model.Port{
			Name:     "default",
			Port:     80,

				}
			}

			if tt.sidecarConfig != nil {
				dr := sidecarScope.DestinationRule(TrafficDirectionOutbound,
					&Proxy{
						Labels:          tt.sidecarConfig.Labels,
						Metadata:        &NodeMetadata{Labels: tt.sidecarConfig.Labels},
						ConfigNamespace: tt.sidecarConfig.Namespace,
					}, host.Name("httpbin.org")).GetRule()
				assert.Equal(t, dr, tt.expectedDr)
			}
		})
	}
}

	default:
		certProxy := &model.Proxy{}
		certProxy.IstioVersion = proxy.IstioVersion
		// If certificate files are specified in gateway configuration, use file based SDS.
		certProxy.Metadata = &model.NodeMetadata{
			TLSServerCertChain: serverTLSSettings.ServerCertificate,
			TLSServerKey:       serverTLSSettings.PrivateKey,
			TLSServerRootCert:  serverTLSSettings.CaCertificates,
		}