test.SetForTest(t, &features.EnableSidecarServiceInboundListenerMerge, true)
		testInboundListenerConfigWithSidecarIngressPortMergeServicePort(t, getProxy(),
			buildServiceWithPort("test1.com", 80, protocol.HTTP, tnow.Add(1*time.Second)))
	})
	t.Run("merge sidecar ingress and service ports, same port in both sidecar and service", func(t *testing.T) {

			Address: workloadEntry.Spec.(*networking.WorkloadEntry).Address,
			Port:    80,
		}}
		expectServiceEndpoints(t, fx, expectedSvc, 80, instances)
	})

	istiotest.SetForTest(t, &features.EnableSidecarHBONEListening, true)
	istiotest.SetForTest(t, &features.EnableAmbient, true)
	for _, ambient := range []bool{false, true} {
		name := "disabled"
		if ambient {
			name = "enabled"
		}
		m := mesh.DefaultMeshConfig()

    kubernetes.io/service-name: headless
endpoints:
- addresses:
  - 1.2.3.4
ports:
` + ports,
		calls: calls,
	},
	)
}

func TestExternalNameServices(t *testing.T) {
	test.SetForTest(t, &features.EnableExternalNameAlias, true)
	ports := `
  - name: http
    port: 80
  - name: auto
    port: 81
  - name: tcp
    port: 82
  - name: tls
    port: 83
  - name: https

			},
		},
	}

	OptimizedConfigRebuildModes := []bool{true, false}
	for _, tt := range cases {
		for _, mode := range OptimizedConfigRebuildModes {
			t.Run(tt.name, func(t *testing.T) {
				test.SetForTest(t, &features.OptimizedConfigRebuild, mode)
				env := &Environment{}
				store := NewFakeStore()
				for _, cfg := range initialEnvoyFilters {
					_, _ = store.Create(cfg)
				}
				env.ConfigStore = store

					},
					Sni: "some-sni.com",
				},
				err: nil,
			},
		},
	}
	for _, tc := range testCases {
		t.Run(tc.name, func(t *testing.T) {
			test.SetForTest(t, &features.EnableAutoSni, tc.enableAutoSni)
			test.SetForTest(t, &features.VerifyCertAtClient, tc.enableVerifyCertAtClient)
			var proxy *model.Proxy
			if tc.router {
				proxy = newGatewayProxy()
			} else {
				proxy = newSidecarProxy()

	}
	sort.Strings(got)

	assert.Equal(t, want, got)
}

func TestExternalNameServiceInstances(t *testing.T) {
	t.Run("alias", func(t *testing.T) {
		test.SetForTest(t, &features.EnableExternalNameAlias, true)
		controller, fx := NewFakeControllerWithOptions(t, FakeControllerOptions{})
		createExternalNameService(controller, "svc5", "nsA",
			[]int32{1, 2, 3}, "foo.co", t, fx)

		Hostname: "jwt-token-issuer.mesh.svc.cluster.local",
	}
	for _, c := range cases {
		t.Run(c.name, func(t *testing.T) {
			istiotest.SetForTest(t, &features.JwksFetchMode, c.jwksFetchMode)
			if got := newPolicyApplier("root-namespace", c.in, nil, push).JwtFilter(false, false); !reflect.DeepEqual(c.expected, got) {

		out, _ := generateVirtualHostDomains(service, port, port, node)
		assert.Equal(t, out, want)
	}

	for _, c := range cases {
		c := c
		t.Run(c.name, func(t *testing.T) {
			test.SetForTest[bool](t, &features.EnableDualStack, c.enableDualStack)
			testFn(t, c.service, c.port, c.node, c.want)
		})
	}
}

func TestSidecarOutboundHTTPRouteConfigWithDuplicateHosts(t *testing.T) {

			},
			oldestWins: true,
		},
	}

	for _, tt := range tests {
		t.Run(tt.name, func(t *testing.T) {
			if tt.oldestWins {
				test.SetForTest(t, &features.PersistOldestWinsHeuristicForVirtualServiceHostMatching, true)
			}
			index := computeWildcardHostVirtualServiceIndex(tt.virtualServices, tt.services)
			if !reflect.DeepEqual(tt.expectedIndex, index) {

}

func TestDefaultAllowWaypointPolicy(t *testing.T) {
	// while the Waypoint is in testNS, the policies live in the Pods' namespaces
	policyName := "ns1/istio_allow_waypoint_" + testNS + "_" + "waypoint-ns"
	test.SetForTest(t, &features.DefaultAllowFromWaypoint, true)

	s := newAmbientTestServer(t, testC, testNW)
	setupPolicyTest(t, s)

	t.Run("policy with service accounts", func(t *testing.T) {