// * Use security.istio.io/tlsMode if its present
	// * If not, set TLS mode if ServiceAccount is specified
	tlsMode := model.DisabledTLSModeLabel
	if val, exists := wle.Labels[label.SecurityTlsMode.Name]; exists {
		tlsMode = val
	} else if wle.ServiceAccount != "" {
		tlsMode = model.IstioMutualTLSModeLabel
	}

	return tlsMode
}

	}

	return &model.IstioEndpoint{
		Labels:                b.labels,
		ServiceAccount:        b.serviceAccount,
		Locality:              b.locality,
		TLSMode:               b.tlsMode,
		Address:               endpointAddress,
		EndpointPort:          uint32(endpointPort),
		ServicePortName:       svcPortName,
		Network:               networkID,
		WorkloadName:          b.workloadName,

spec:
  hosts:
  - example.com
  ports:
  - number: 7070
    name: tcp
    protocol: TCP
  resolution: STATIC
  location: MESH_INTERNAL
  endpoints:
  - address: 1.1.1.1
    labels:
      security.istio.io/tlsMode: istio
---
# Set up .Services number of services.
{{- range $i := until .Services }}
apiVersion: networking.istio.io/v1alpha3
kind: ServiceEntry
metadata:
  name: service-{{$i}}
spec:
  addresses:

    name: https
    protocol: HTTPS
  - number: 9090
    name: auto
    protocol: ""
  resolution: STATIC
  location: MESH_INTERNAL
  endpoints:
  - address: 1.1.1.1
    labels:
      security.istio.io/tlsMode: istio
---
# Set up .Services number of services. Each will have 4 ports (one for each protocol)
{{- range $i := until .Services }}
apiVersion: networking.istio.io/v1alpha3
kind: ServiceEntry
metadata:

// on the DR, original endpoint TLSMode (based on injection of sidecar), and PeerAuthentication settings.
func (c *mtlsChecker) checkMtlsEnabled(ep *model.IstioEndpoint, isWaypoint bool) bool {
	if drMode := c.destinationRule; drMode != nil {
		return *drMode == networkingapi.ClientTLSSettings_ISTIO_MUTUAL
	}

	// if endpoint has no sidecar or explicitly tls disabled by "security.istio.io/tlsMode" label.

spec:
  hosts:
  - example.com
  ports:
  - number: 7070
    name: auto
    protocol: ""
  resolution: STATIC
  location: MESH_INTERNAL
  endpoints:
  - address: 1.1.1.1
    labels:
      security.istio.io/tlsMode: istio
---
# Set up .Services number of services.
{{- range $i := until .Services }}
apiVersion: networking.istio.io/v1alpha3
kind: ServiceEntry
metadata:
  name: service-{{$i}}
spec:
  addresses:

spec:
  hosts:
  - example.com
  ports:
  - number: 7070
    name: tls
    protocol: TLS
  resolution: STATIC
  location: MESH_INTERNAL
  endpoints:
  - address: 1.1.1.1
    labels:
      security.istio.io/tlsMode: istio
---
# Set up .Services number of services.
{{- range $i := until .Services }}
apiVersion: networking.istio.io/v1alpha3
kind: ServiceEntry
metadata:
  name: service-{{$i}}
spec:
  addresses:

spec:
  hosts:
  - example.com
  ports:
  - number: 80
    name: http
    protocol: HTTP
  resolution: STATIC
  location: MESH_INTERNAL
  endpoints:
  - address: 1.1.1.1
    labels:
      security.istio.io/tlsMode: istio
---
# Set up .Services number of services.
{{- range $i := until .Services }}
apiVersion: networking.istio.io/v1alpha3
kind: ServiceEntry
metadata:
  name: service-{{$i}}
spec:
  addresses:

		},
	}

	cases := []struct {
		name    string
		tlsMode networking.ClientTLSSettings_TLSmode
		meta    *core.Metadata
		want    *core.Metadata
	}{
		{
			name:    "ISTIO_MUTUAL TLS",
			tlsMode: networking.ClientTLSSettings_ISTIO_MUTUAL,
			meta:    nil,
			want:    nil,
		},
		{
			name:    "DISABLED TLS",
			tlsMode: networking.ClientTLSSettings_DISABLE,
			meta:    nil,
			want:    nil,

	svc := services[0] // default
	for _, s := range services {
		if string(s.Hostname) == address {
			svc = s
			break
		}
	}
	tlsMode := model.DisabledTLSModeLabel
	if mtlsMode == MTLS || mtlsMode == MTLSUnlabelled {
		tlsMode = model.IstioMutualTLSModeLabel
	}
	if mtlsMode == MTLS {
		if svcLabels == nil {
			svcLabels = map[string]string{}
		}