cni,TestCNIReachability/global-mtls-on/naked->http://headless:http
cni,TestCNIReachability/global-mtls-on/naked->http://multiversion:http
cni,TestCNIReachability/global-mtls-on/naked->http://naked:http
cni,TestCNIReachability/global-mtls-on/naked->tcp://a:tcp
cni,TestCNIReachability/global-mtls-on/naked->tcp://b:tcp
cni,TestCNIReachability/global-mtls-on/naked->tcp://multiversion:tcp
cni,TestCNIReachability/global-mtls-on/naked->tcp://naked:tcp

		case namespacedName.Name == "server":
			server = apps.EchoNamespace.All[index]
		case namespacedName.Name == "server-naked-foo":
			serverNakedFoo = apps.EchoNamespace.All[index]
		case namespacedName.Name == "server-naked-bar":
			serverNakedBar = apps.EchoNamespace.All[index]
		case namespacedName.Name == "server-naked-foo-alt":
			serverNakedFooAlt = apps.EchoNamespace.All[index]
		}
	}
	return nil
}

					// Request from trust domain foo should be allowed.
					verify(t, naked, "bar", httpMTLS, scheme.HTTPS, false)
					verify(t, naked, "bar", tcpMTLS, scheme.TCP, false)
					verify(t, naked, "bar", passThrough, scheme.TCP, false)
					verify(t, naked, "foo", httpMTLS, scheme.HTTPS, true)
					verify(t, naked, "foo", tcpMTLS, scheme.TCP, true)
					verify(t, naked, "foo", passThrough, scheme.TCP, true)
				})
			}
		})
}

// 3. Two naked server workloads with custom certs whose URI SAN have different SPIFFE trust domains.
// 4. PeerAuthentication with strict mtls, to enforce the mtls connection.
// 5. DestinaitonRule with tls ISTIO_MUTUAL mode, because Istio auto mTLS will let client send plaintext to naked servers by default.
// 6. MeshConfig.TrustDomainAliases contains one of the trust domain "server-naked-foo".
//
// Expectation:

}

// reachableNakedDestinations filters out naked instances that aren't on the same network.
// While External services are considered "naked", we won't see 500s due to different loadbalancing.
func reachableNakedDestinations(from echo.Instance) match.Matcher {
	srcNw := from.Config().Cluster.NetworkName()
	excluded := match.And(
		// Only exclude naked if all subsets are naked. If an echo instance contains a mix of

	// naked pod (uninjected)
	naked1 = &fakeInstance{Cluster: cls1, Namespace: echo1NS, Service: "naked", Subsets: []echo.SubsetConfig{{
		Annotations: map[string]string{annotation.SidecarInject.Name: "false"},
	}}}
	naked2 = &fakeInstance{Cluster: cls2, Namespace: echo1NS, Service: "naked", Subsets: []echo.SubsetConfig{{

												t.Skip("https://github.com/istio/istio/issues/37307")
											}

											from.CallOrFail(t, opts)
										})
								}
							}
						}
					})
				}
			}
		})
	}
}

// Exclude calls from naked->VM since naked has no Envoy
// However, no endpoint exists for VM in k8s, so calls from naked->VM will fail, regardless of mTLS

var External Matcher = func(i echo.Instance) bool {
	return i.Config().IsExternal()
}

// NotExternal is equivalent to Not(External)
var NotExternal = Not(External)

// Naked matches instances with any subset marked with SidecarInject equal to false.
var Naked Matcher = func(i echo.Instance) bool {
	return i.Config().IsNaked()
}

// AllNaked matches instances where every subset has SidecarInject set to false.

type WorkloadClass = string

const (
	Proxyless   WorkloadClass = "proxyless"
	VM          WorkloadClass = "vm"
	Sotw        WorkloadClass = "sotw"
	TProxy      WorkloadClass = "tproxy"
	Naked       WorkloadClass = "naked"
	External    WorkloadClass = "external"
	StatefulSet WorkloadClass = "statefulset"
	Headless    WorkloadClass = "headless"
	Captured    WorkloadClass = "captured"
	Waypoint    WorkloadClass = "waypoint"

  selector:
    matchLabels:
      app: multiversion
      version: v-istio
  template:
    metadata:
      labels:
        app: multiversion
        version: v-istio
        test.istio.io/class: naked
      annotations:
        prometheus.io/scrape: "true"
        prometheus.io/port: "15014"
    spec:
      imagePullSecrets:
      - name: myregistrykey
      containers:
      - name: istio-proxy