makeInstance(httpStatic, "2.2.2.2", 18080, httpStatic.Spec.(*networking.ServiceEntry).Ports[1], nil, MTLS),
		makeInstance(httpStatic, "3.3.3.3", 1080, httpStatic.Spec.(*networking.ServiceEntry).Ports[0], nil, MTLS),
		makeInstance(httpStatic, "3.3.3.3", 8080, httpStatic.Spec.(*networking.ServiceEntry).Ports[1], nil, MTLS),

	})

	t.Run("External only: the port name of the workloadEntry and serviceEntry does not match, "+
		"and the serivceEntry target port is not set, use serviceEntry port.number", func(t *testing.T) {
		store, _, fx := setupTest(t)
		makeIstioObject(t, store, serviceEntry)
		makeIstioObject(t, store, config.Config{
			Meta: config.Meta{
				Name:             "workload",

	case gvk.ServiceEntry:
		oldRes := &apiistioioapinetworkingv1alpha3.ServiceEntry{
			ObjectMeta: origMeta,
			Spec:       *(orig.Spec.(*istioioapinetworkingv1alpha3.ServiceEntry)),
		}
		modRes := &apiistioioapinetworkingv1alpha3.ServiceEntry{
			ObjectMeta: modMeta,
			Spec:       *(mod.Spec.(*istioioapinetworkingv1alpha3.ServiceEntry)),
		}

    - destination:
        host: "{{.Destination}}"
`).ApplyOrFail(t)

			cfg := config.YAML(`
{{ $to := .To }}
apiVersion: networking.istio.io/v1beta1
kind: ServiceEntry
metadata:
  name: test-se
spec:
  hosts:
  - serviceentry.istio.io # not used
  addresses:
  - 111.111.222.222
  ports:
  - number: 80
    name: http
    protocol: HTTP
  resolution: {{.Resolution}}

	var ns string
	// Currently supported types are Gateway, Service, and ServiceEntry
	if kind == gvk.KubernetesGateway.Kind && group == gvk.KubernetesGateway.Group {
		ik = gvk.KubernetesGateway
	} else if kind == gvk.Service.Kind && group == gvk.Service.Group {
		ik = gvk.Service
	} else if kind == gvk.ServiceEntry.Kind && group == gvk.ServiceEntry.Group {
		ik = gvk.ServiceEntry
	} else {

		s.clusterID, testNS, wleName)
}

// Returns the XDS resource name for the given ServiceEntry IP address.
func (s *ambientTestServer) seIPXdsName(name string, ip string) string {
	return fmt.Sprintf("%s/networking.istio.io/ServiceEntry/%s/%s/%s",
		s.clusterID, testNS, name, ip)
}

					Ports:    port803x,
					Attributes: ServiceAttributes{
						Name:      "foo",
						Namespace: "ns1",
					},
				},
			},
		},
		{
			name:          "multi-port-merge: serviceentry not merge with another namespace",
			sidecarConfig: configs22,
			services: []*Service{
				{
					Hostname: "foobar.svc.cluster.local",
					Ports:    port803x[:3],
					Attributes: ServiceAttributes{

		wasmPluginsChanged, proxyConfigsChanged bool

	changedEnvoyFilters := sets.New[ConfigKey]()

	for conf := range pushReq.ConfigsUpdated {
		switch conf.Kind {
		case kind.ServiceEntry, kind.DNSName:
			servicesChanged = true
		case kind.DestinationRule:
			destinationRulesChanged = true
		case kind.VirtualService:
			virtualServicesChanged = true
		case kind.Gateway:

	//
	// cluster/group/kind/namespace/name/section-name
	//
	// As an example, a ServiceEntry with two WorkloadEntries inlined could become
	// two Workloads with the following UIDs:
	// - cluster1/networking.istio.io/v1alpha3/ServiceEntry/default/external-svc/endpoint1
	// - cluster1/networking.istio.io/v1alpha3/ServiceEntry/default/external-svc/endpoint2
	//

metadata:
  name: default
  namespace: istio-system
spec:
  mtls:
    mode: %s
`, m)
}

func TestInbound(t *testing.T) {
	svc := `
apiVersion: networking.istio.io/v1alpha3
kind: ServiceEntry
metadata:
  name: se
spec:
  hosts:
  - foo.bar
  endpoints:
  - address: 1.1.1.1
  location: MESH_INTERNAL
  resolution: STATIC
  ports:
  - name: tcp
    number: 70