args: strings.Split("service productpage", " "),
			expectedOutput: `Service: productpage
DestinationRule: productpage for "productpage"
   WARNING POD DOES NOT MATCH ANY SUBSETS.  (Non matching subsets v1)
   Matching subsets: 
      (Non-matching subsets v1)
   No Traffic Policy
VirtualService: bookinfo
   Route to host "productpage" with weight 30%
   Route to host "productpage2" with weight 20%

}

// getDestRuleSubsets gets names of subsets that match any pod labels (also, ones that don't match).
func getDestRuleSubsets(subsets []*v1alpha3.Subset, podsLabels []klabels.Set) ([]string, []string) {
	matchingSubsets := make([]string, 0, len(subsets))
	nonmatchingSubsets := make([]string, 0, len(subsets))
	for _, subset := range subsets {
		subsetSelector := klabels.SelectorFromSet(subset.Labels)

  name: istiod{{- if .Values.revision }}-{{ .Values.revision}}{{- end }}-remote
  {{- else }}
  name: istiod{{- if .Values.revision }}-{{ .Values.revision}}{{- end }}
  {{- end }}
  namespace: {{ .Release.Namespace }}
subsets:
- addresses:
  - ip: {{ .Values.global.remotePilotAddress }}
  ports:
  - port: 15012
    name: tcp-istiod
    protocol: TCP
  - port: 15017
    name: tcp-webhook
    protocol: TCP
---

  name: istiod{{- if .Values.revision }}-{{ .Values.revision}}{{- end }}-remote
  {{- else }}
  name: istiod{{- if .Values.revision }}-{{ .Values.revision}}{{- end }}
  {{- end }}
  namespace: {{ .Release.Namespace }}
subsets:
- addresses:
  - ip: {{ .Values.global.remotePilotAddress }}
  ports:
  - port: 15012
    name: tcp-istiod
    protocol: TCP
  - port: 15017
    name: tcp-webhook
    protocol: TCP
---

    }
  }

  /**
   * Returns the set of all possible subsets of {@code set}. For example, {@code
   * powerSet(ImmutableSet.of(1, 2))} returns the set {@code {{}, {1}, {2}, {1, 2}}}.
   *
   * <p>Elements appear in these subsets in the same iteration order as they appeared in the input
   * set. The order in which these subsets appear in the outer set is undefined. Note that the power

      for (int j = i + 1; j <= 20; j++) {
        assertEquals(expectedSet.subSet(i, false, j, false), asSet.subSet(i, false, j, false));
        assertEquals(expectedSet.subSet(i, true, j, false), asSet.subSet(i, true, j, false));
        assertEquals(expectedSet.subSet(i, false, j, true), asSet.subSet(i, false, j, true));
        assertEquals(expectedSet.subSet(i, true, j, true), asSet.subSet(i, true, j, true));
      }
    }
  }

      for (int j = i + 1; j <= 20; j++) {
        assertEquals(expectedSet.subSet(i, false, j, false), asSet.subSet(i, false, j, false));
        assertEquals(expectedSet.subSet(i, true, j, false), asSet.subSet(i, true, j, false));
        assertEquals(expectedSet.subSet(i, false, j, true), asSet.subSet(i, false, j, true));
        assertEquals(expectedSet.subSet(i, true, j, true), asSet.subSet(i, true, j, true));
      }
    }
  }

	clearEntriesWithComment(name string, comment string) error
	clearEntriesWithIP(name string, ip netip.Addr) error
	listEntriesByIP(name string) ([]netip.Addr, error)
}

// TODO this should actually create v6 and v6 subsets of type `hash:ip`, add them both to a
// superset of type `list:set` - we can then query the superset directly in iptables (with the same rule),

			verificationImpacted = verificationImpacted || checkVerify(pl.GetTls())
			sniImpacted = sniImpacted || checkSNI(pl.GetTls())
		}
		for _, ss := range dr.Spec.Subsets {
			verificationImpacted = verificationImpacted || checkVerify(ss.GetTrafficPolicy().GetTls())
			sniImpacted = sniImpacted || checkSNI(ss.GetTrafficPolicy().GetTls())

		ep := mustGetEndpoint(g, objs, "istiod-remote").Unstructured()
		g.Expect(ep).Should(HavePathValueEqual(PathValue{"subsets.[0].addresses.[0]", endpointSubsetAddressVal("", "169.10.112.88", "")}))
		g.Expect(ep).Should(HavePathValueContain(PathValue{"subsets.[0].ports.[0]", portVal("tcp-istiod", 15012, -1)}))

		checkClusterRoleBindingsReferenceRoles(g, objs)
	}
}

func TestPrune(t *testing.T) {