case namespacedName.Name == "server":
			server = apps.EchoNamespace.All[index]
		case namespacedName.Name == "server-naked-foo":
			serverNakedFoo = apps.EchoNamespace.All[index]
		case namespacedName.Name == "server-naked-bar":
			serverNakedBar = apps.EchoNamespace.All[index]
		case namespacedName.Name == "server-naked-foo-alt":
			serverNakedFooAlt = apps.EchoNamespace.All[index]
		}
	}
	return nil
}

					// Request from trust domain foo should be allowed.
					verify(t, naked, "bar", httpMTLS, scheme.HTTPS, false)
					verify(t, naked, "bar", tcpMTLS, scheme.TCP, false)
					verify(t, naked, "bar", passThrough, scheme.TCP, false)
					verify(t, naked, "foo", httpMTLS, scheme.HTTPS, true)
					verify(t, naked, "foo", tcpMTLS, scheme.TCP, true)
					verify(t, naked, "foo", passThrough, scheme.TCP, true)
				})
			}
		})
}

// 3. Two naked server workloads with custom certs whose URI SAN have different SPIFFE trust domains.
// 4. PeerAuthentication with strict mtls, to enforce the mtls connection.
// 5. DestinaitonRule with tls ISTIO_MUTUAL mode, because Istio auto mTLS will let client send plaintext to naked servers by default.
// 6. MeshConfig.TrustDomainAliases contains one of the trust domain "server-naked-foo".
//
// Expectation:

}

// reachableNakedDestinations filters out naked instances that aren't on the same network.
// While External services are considered "naked", we won't see 500s due to different loadbalancing.
func reachableNakedDestinations(from echo.Instance) match.Matcher {
	srcNw := from.Config().Cluster.NetworkName()
	excluded := match.And(
		// Only exclude naked if all subsets are naked. If an echo instance contains a mix of

	// naked pod (uninjected)
	naked1 = &fakeInstance{Cluster: cls1, Namespace: echo1NS, Service: "naked", Subsets: []echo.SubsetConfig{{
		Annotations: map[string]string{annotation.SidecarInject.Name: "false"},
	}}}
	naked2 = &fakeInstance{Cluster: cls2, Namespace: echo1NS, Service: "naked", Subsets: []echo.SubsetConfig{{

var External Matcher = func(i echo.Instance) bool {
	return i.Config().IsExternal()
}

// NotExternal is equivalent to Not(External)
var NotExternal = Not(External)

// Naked matches instances with any subset marked with SidecarInject equal to false.
var Naked Matcher = func(i echo.Instance) bool {
	return i.Config().IsNaked()
}

// AllNaked matches instances where every subset has SidecarInject set to false.

type WorkloadClass = string

const (
	Proxyless   WorkloadClass = "proxyless"
	VM          WorkloadClass = "vm"
	Sotw        WorkloadClass = "sotw"
	TProxy      WorkloadClass = "tproxy"
	Naked       WorkloadClass = "naked"
	External    WorkloadClass = "external"
	StatefulSet WorkloadClass = "statefulset"
	Headless    WorkloadClass = "headless"
	Captured    WorkloadClass = "captured"
	Waypoint    WorkloadClass = "waypoint"

	ESvc             = "e"
	TproxySvc        = "tproxy"
	VMSvc            = "vm"
	HeadlessSvc      = "headless"
	StatefulSetSvc   = "statefulset"
	ProxylessGRPCSvc = "proxyless-grpc"
	NakedSvc         = "naked"
	SotwSvc          = "sotw"
	WaypointSvc      = "waypoint"
	CapturedSvc      = "captured"
)

// EchoNamespace contains the echo instances for a single namespace.
type EchoNamespace struct {

func (c Config) IsAllNaked() bool {
	if len(c.Subsets) == 0 {
		// No subsets - default to not-naked.
		return false
	}
	// if ANY subset has a sidecar, not naked.
	for _, s := range c.Subsets {
		if s.Annotations == nil || s.Annotations[annotation.SidecarInject.Name] != "false" {
			// Sidecar injection is enabled - it's not naked.
			return false
		}
	}
	// All subsets were annotated indicating no sidecar injection.

	CSvc             = "c"
	DSvc             = "d"
	ESvc             = "e"
	MultiversionSvc  = "multiversion"
	VMSvc            = "vm"
	HeadlessSvc      = "headless"
	NakedSvc         = "naked"
	HeadlessNakedSvc = "headless-naked"
	ExternalSvc      = "external"
)

type EchoDeployments struct {
	// TODO: Consolidate the echo config and reduce/reuse echo instances (https://github.com/istio/istio/issues/28599)