// to your compiler flags.
# define GTEST_HAS_PTHREAD (GTEST_OS_LINUX || GTEST_OS_MAC || GTEST_OS_HPUX \
    || GTEST_OS_QNX)
#endif  // GTEST_HAS_PTHREAD

#if GTEST_HAS_PTHREAD
// gtest-port.h guarantees to #include <pthread.h> when GTEST_HAS_PTHREAD is
// true.
# include <pthread.h>  // NOLINT

// For timespec and nanosleep, used below.
# include <time.h>  // NOLINT
#endif

  **Fixed** a bug when a Sidecar is resource is defined with multiple egress listeners with different ports 
  of a Kubernetes service, does not merge the ports correctly. This leads to creating only one Cluster with 

apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
  name: db-tls
spec:
  host: mydbserver.prod.svc.cluster.local
  trafficPolicy:
    portLevelSettings:
      - port:
          number: 443
        tls:
          mode: SIMPLE

apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
  name: db-tls
spec:
  host: mydbserver.prod.svc.cluster.local
  trafficPolicy:
    portLevelSettings:
      - port:
          number: 443
        tls:
          mode: SIMPLE
          credentialName: db-credential
  workloadSelector:
      matchLabels:

          - --xds-grpc-server={{ $p.Port }}
{{- else if eq .Protocol "GRPC" }}
          - --grpc={{ $p.Port }}
{{- else if eq .Protocol "TCP" }}
          - --tcp={{ $p.Port }}
{{- else }}
          - --port={{ $p.Port }}
{{- end }}
{{- if $p.TLS }}
          - --tls={{ $p.Port }}
{{- end }}
{{- if $p.ServerFirst }}
          - --server-first={{ $p.Port }}
{{- end }}
{{- if $p.InstanceIP }}

								expect := expect
								p := expect.port
								opts := echo.CallOptions{
									// Do not set To, otherwise fillInCallOptions() will
									// complain with port does not match.
									ToWorkload: to.Instances()[0],
									Port: echo.Port{
										Protocol: p.Protocol,

										// The ServicePort tells the client which port to connect to.

 - address: 1.1.1.1
 location: MESH_INTERNAL
 resolution: STATIC
 ports:
 - name: http
   number: 8000
   protocol: HTTP
---`
	mkCall := func(port int, tls simulation.TLSMode) simulation.Call {
		r := simulation.Call{Protocol: simulation.HTTP, Port: port, CallMode: simulation.CallModeInbound, TLS: tls}
		if tls == simulation.MTLS {
			r.Alpn = "istio"
		}
		return r
	}
	cases := []struct {
		name   string

		klog.Warningf("port is not in the range when release it. port: %v", port)
		return nil
	}

	err := r.alloc.Release(offset)
	if err == nil {
		// update metrics
		r.metrics.setAllocated(r.Used())
		r.metrics.setAvailable(r.Free())
	}
	return err
}

// Has returns true if the provided port is already allocated and a call
// to Allocate(port) would fail with ErrAllocated.
func (r *PortAllocator) Has(port int) bool {

			port:   basePortRange + sizePortRange,
			errMsg: fmt.Sprintf("provided port is not in the valid range. The range of valid ports is %d-%d", basePortRange, basePortRange+sizePortRange-1),
		},
		{
			name:   "Allocate invalid port",
			port:   -2,

	// Then generate the per-port passthrough filter chains.
	for port := range b.applier.PortLevelSetting() {
		// Skip the per-port passthrough filterchain if the port is already handled by InboundMTLSConfiguration().
		if !needPerPortPassthroughFilterChain(port, b.proxy) {
			continue
		}

		authnLog.Debugf("InboundMTLSConfiguration: build extra pass through filter chain for %v:%d", b.proxy.ID, port)