"headless.default",
				"*.headless.default.svc.cluster.local",
				"*.headless",
				"*.headless.default.svc",
				"*.headless.default",
			},
		},
		{
			name: "dual stack k8s service with default domain",
			service: &model.Service{
				Hostname:       "echo.default.svc.cluster.local",
				MeshExternal:   false,
				DefaultAddress: "1.2.3.4",
				ClusterVIPs: model.AddressMap{

		{Address: "1.2.3.4", Port: 82, Protocol: simulation.TCP, HostHeader: "headless.default.svc.cluster.local"},

		// Use short host name
		{Address: "1.2.3.4", Port: 83, Protocol: simulation.TCP, TLS: simulation.TLS, HostHeader: "headless.default"},
		{Address: "1.2.3.4", Port: 84, Protocol: simulation.HTTP, TLS: simulation.TLS, HostHeader: "headless.default"},
	} {

		}
		// headless service update must trigger nds push, so we trigger a full push.
		if ev := fx.WaitOrFail(t, "xds full"); !ev.Reason.Has(model.HeadlessEndpointUpdate) {
			t.Fatalf("xds push reason does not contain %v: %v", model.HeadlessEndpointUpdate, ev)
		}

		// pure HTTP headless services should not need a full push since they do not

			},
			expectedEndpointFamily: ipv4,
		},
		{
			name:       "v4 headless service, in a single stack cluster",
			ipFamilies: ipv4only,
			service: v1.Service{
				Spec: v1.ServiceSpec{
					ClusterIP: v1.ClusterIPNone,
				},
			},
			expectedEndpointFamily: ipv4,
		},
		{
			name:       "v4 headless service, in a dual stack cluster",
			ipFamilies: ipv4ipv6,
			service: v1.Service{

		buildHTTPService("test-private-2.com", visibility.Private, "9.9.9.10", "not-default", 60),
		buildHTTPService("test-headless.com", visibility.Public, wildcardIP, "not-default", 8888),
		buildHTTPService("test-headless-someother.com", visibility.Public, wildcardIP, "some-other-ns", 8888),
		buildHTTPService("a.test1.wildcard.com", visibility.Public, wildcardIP, "default", 8888),

							listenerOpts.bind.binds = []string{instance.Address}
							lb.buildSidecarOutboundListener(listenerOpts, listenerMap, virtualServices, actualWildcards)
						}
					} else {
						// Standard logic for headless and non headless services
						lb.buildSidecarOutboundListener(listenerOpts, listenerMap, virtualServices, actualWildcards)
					}
				}
			}
		}
	}

	// a workload that backs a Kubernetes service will typically have only endpoints. A
	// workload that backs a headless Kubernetes service, however, will have both
	// addresses as well as a hostname used for direct access to the headless endpoint.
	// TODO: support this field
	Hostname string `protobuf:"bytes,21,opt,name=hostname,proto3" json:"hostname,omitempty"`

			wanted:            MTLSPermissive,
		},
		{
			name:              "headless service with no instances found yet",
			serviceNamespace:  partialNS,
			servicePort:       80,
			serviceResolution: Passthrough,
			wanted:            MTLSDisable,
		},
		{
			name:              "headless service with instances",
			serviceNamespace:  partialNS,
			servicePort:       80,

	fx.WaitOrFail(t, "eds")

	// delete normal service
	clienttest.Wrap(t, controller.services).Delete("svc1", "nsa")
	fx.WaitOrFail(t, "service")

	// 2. full xds push request for headless service endpoint update

	// create a headless service
	createServiceWithoutClusterIP(controller, "svc1", "nsa", nil,
		[]int32{8080}, map[string]string{"app": "prod-app"}, t)
	fx.WaitOrFail(t, "service")

const (
	// EndpointUpdate describes a push triggered by an Endpoint change
	EndpointUpdate TriggerReason = "endpoint"
	// HeadlessEndpointUpdate describes a push triggered by an Endpoint change for headless service
	HeadlessEndpointUpdate TriggerReason = "headlessendpoint"
	// ConfigUpdate describes a push triggered by a config (generally and Istio CRD) change.
	ConfigUpdate TriggerReason = "config"