John Howard <******@****.***> 1682617769 -0700

}

var _ model.XdsResourceGenerator = &LdsGenerator{}

// Map of all configs that do not impact LDS
var skippedLdsConfigs = map[model.NodeType]sets.Set[kind.Kind]{
	model.Router: sets.New(
		// for autopassthrough gateways, we build filterchains per-dr subset
		kind.WorkloadGroup,
		kind.WorkloadEntry,
		kind.Secret,
		kind.ProxyConfig,
		kind.DNSName,
	),
	model.SidecarProxy: sets.New(
		kind.Gateway,

	if event == model.EventDelete {
		gatewaysChanged = len(previousGateways) > 0
		delete(n.gatewaysFromResource, gw.UID)
		return nil
	}

	autoPassthrough := func(l v1beta1.Listener) bool {
		return kube.IsAutoPassthrough(gw.GetLabels(), l)
	}

	base := model.NetworkGateway{
		Network: network.ID(gw.GetLabels()[label.TopologyNetwork.Name]),
		Cluster: n.clusterID,
	}

	verifiedCertificateReferences := sets.New[string]()
	http3AdvertisingRoutes := sets.New[string]()
	tlsHostsByPort := map[uint32]map[string]string{} // port -> host/bind map
	autoPassthrough := false

	log.Debugf("MergeGateways: merging %d gateways", len(gateways))
	for _, gwAndInstance := range gateways {
		gatewayConfig := gwAndInstance.gateway

	RunCase("sniffing", protocolSniffingCases)
	RunCase("selfcall", selfCallsCases)
	RunSkipAmbient("serverfirst", serverFirstTestCases, "Expected success cases time out")
	RunCase("gateway", gatewayCases)
	RunCase("autopassthrough", autoPassthroughCases)
	RunSkipAmbient("loop", trafficLoopCases, "does not error (waypoint -> waypoint)")
	RunSkipAmbient("tls-origination", tlsOriginationCases, "not workload agnostic")

  namespace: istio-system
spec:
  servers:
  - hosts:
    - istio-system/*.local
    port:
      name: default
      number: 35443
      protocol: TLS
    tls:
      mode: AUTO_PASSTHROUGH
---
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  annotations:
    internal.istio.io/parents: TLSRoute/eastwestgateway-grpc.istio-system
    internal.istio.io/route-semantics: gateway

		UsePost:  tunnelSettings.Protocol == "POST",
	}
}

// Skip has no effect; its only purpose is to avoid passing nil values for ApplyFunc arguments
// when it is not desired to apply `tunneling_config` to a listener, e.g. AUTO_PASSTHROUGH

  namespace: istio-system
spec:
  servers:
  - hosts:
    - istio-system/*.local
    port:
      name: default
      number: 35443
      protocol: TLS
    tls:
      mode: AUTO_PASSTHROUGH
---
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  annotations:
    internal.istio.io/parents: TLSRoute/eastwestgateway-grpc.istio-system
    internal.istio.io/route-semantics: gateway

  namespace: istio-system
spec:
  servers:
  - hosts:
    - istio-system/*.local
    port:
      name: default
      number: 15443
      protocol: TLS
    tls:
      mode: AUTO_PASSTHROUGH
---
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  annotations:
    internal.istio.io/parents: TLSRoute/eastwestgateway-grpc.istio-system
    internal.istio.io/route-semantics: gateway

func PodTLSMode(pod *corev1.Pod) string {
	if pod == nil {
		return model.DisabledTLSModeLabel
	}
	return model.GetTLSModeFromEndpointLabels(pod.Labels)
}

// IsAutoPassthrough determines if a listener should use auto passthrough mode. This is used for
// multi-network. In the Istio API, this is an explicit tls.Mode. However, this mode is not part of