{
					Name:   "mtls",
					Call:   mkCall(8000, simulation.MTLS),
					Result: simulation.Result{ClusterMatched: "InboundPassthroughCluster"},
				},
				{
					Name:   "plaintext",
					Call:   mkCall(8000, simulation.Plaintext),
					Result: simulation.Result{ClusterMatched: "InboundPassthroughCluster"},
				},
			},
		},
		{
			name:   "global strict",
			config: paStrict,
			calls: []simulation.Expect{

		{
			"no config",
			[]string{"outbound|8080||static.test", "BlackHoleCluster", "PassthroughCluster", "InboundPassthroughCluster"},
			nil,
			model.SidecarProxy,
			service,
		},
		{
			"add cluster",
			[]string{"outbound|8080||static.test", "BlackHoleCluster", "PassthroughCluster", "InboundPassthroughCluster", "new-cluster1"},
			[]*networking.EnvoyFilter{{

				CallMode: simulation.CallModeInbound,
			},
			Disabled: simulation.Result{
				ClusterMatched: "InboundPassthroughCluster",
			},
			Permissive: simulation.Result{
				ClusterMatched: "InboundPassthroughCluster",
			},
			Strict: simulation.Result{
				ClusterMatched: "InboundPassthroughCluster",
			},
		},
	}
	t.Run("Disable", func(t *testing.T) {
		calls := []simulation.Expect{}

	"istio.io/istio/pilot/pkg/model"
	v3 "istio.io/istio/pilot/pkg/xds/v3"
	"istio.io/istio/pkg/slices"
	"istio.io/istio/pkg/util/sets"
)

var knownOptimizationGaps = sets.New(
	"BlackHoleCluster",
	"InboundPassthroughCluster",
	"PassthroughCluster",
)

// compareDiff compares a Delta and SotW XDS response. This allows checking that the Delta XDS

		ResourceNamesUnsubscribe: []string{"outbound|81||local.default.svc.cluster.local"},
	})
	ads.ExpectNoResponse()
}

func TestDeltaCDS(t *testing.T) {
	base := sets.New("BlackHoleCluster", "PassthroughCluster", "InboundPassthroughCluster")
	assertResources := func(resp *discovery.DeltaDiscoveryResponse, names ...string) {
		t.Helper()
		got := slices.Map(resp.Resources, (*discovery.Resource).GetName)

	PassthroughFilterChain = "PassthroughFilterChain"

	// Inbound pass through cluster need to the bind the loopback ip address for the security and loop avoidance.
	InboundPassthroughCluster = "InboundPassthroughCluster"

	// IstioMetadataKey is the key under which metadata is added to a route or cluster
	// regarding the virtual service or destination rule used for each
	IstioMetadataKey = "istio"

				Address:       InboundPassthroughBindIpv6,
				PortSpecifier: &core.SocketAddress_PortValue{PortValue: uint32(0)},
			},
		})
	}
	c := cb.buildDefaultPassthroughCluster()
	c.Name = util.InboundPassthroughCluster
	c.Filters = nil
	c.UpstreamBindConfig = &core.BindConfig{
		SourceAddress: &core.SocketAddress{
			Address:       src,
			PortSpecifier: &core.SocketAddress_PortValue{PortValue: uint32(0)},
		},

					// but this is backwards compatible and there aren't any perfect options.
					Port:     0,
					Protocol: protocol.Unsupported,
				},
				TargetPort: mtls.Port,
			},
			clusterName: util.InboundPassthroughCluster,
			passthrough: true,
			hbone:       lb.node.IsWaypointProxy(),
		}
		opts := getFilterChainMatchOptions(mtls, istionetworking.ListenerProtocolAuto)