security,TestReachability/beta-mtls-automtls/naked->ws://headless:http
security,TestReachability/beta-mtls-automtls/naked->ws://multiversion:http
security,TestReachability/beta-mtls-automtls/naked->ws://naked:http
security,TestReachability/beta-mtls-off
security,TestReachability/beta-mtls-off/a->grpc://a:grpc
security,TestReachability/beta-mtls-off/a->grpc://b:grpc
security,TestReachability/beta-mtls-off/a->grpc://headless:grpc

	"istio.io/istio/pkg/test/framework/components/istio"
	"istio.io/istio/pkg/test/framework/components/namespace"
)

// TestReachability verifies:
// (a) Different workloads after getting their certificates signed by the K8s CA are successfully able to communicate with each other
func TestReachability(t *testing.T) {
	framework.NewTest(t).
		Run(func(t framework.TestContext) {
			istioCfg := istio.DefaultConfigOrFail(t, t)

test.integration.kube.environment: | $(JUNIT_REPORT) check-go-tag
ifeq (${JOB_TYPE},postsubmit)
	$(call run-test,./tests/integration/...)
else
	$(call run-test,./tests/integration/security/ ./tests/integration/pilot,-run="TestReachability|TestTraffic|TestGatewayConformance")

values:
  pilot:
    env:
      ISTIO_MULTIROOT_MESH: true
  meshConfig:
    defaultConfig:
      proxyMetadata:
        PROXY_CONFIG_XDS_AGENT: "true"
`
	cfg.ControlPlaneValues = cfgYaml
}

func TestReachability(t *testing.T) {
	framework.NewTest(t).
		Run(func(t framework.TestContext) {
			istioCfg := istio.DefaultConfigOrFail(t, t)
			istioCtl := istioctl.NewOrFail(t, t, istioctl.Config{})

	mtlsModeParam            = "MTLSMode"
	mtlsModeOverrideParam    = "MTLSModeOverride"
	tlsModeParam             = "TLSMode"
	cMinIstioVersion         = "1.15.0"
	// cMinIstioVersionDS       = "1.16.0"
)

func TestReachability(t *testing.T) {
	framework.NewTest(t).
		Run(func(t framework.TestContext) {
			systemNS := istio.ClaimSystemNamespaceOrFail(t, t)

			integIstioVersion := cMinIstioVersion
			var migrationApp echo.Instances

			Port:   echo.Port{ServicePort: 8080},
			Check: check.And(
				check.OK(),
				check.RequestHeader("X-Envoy-Attempt-Count", "")),
		},
	})
}

// TODO: merge with security TestReachability code
func protocolSniffingCases(t TrafficContext) {
	type protocolCase struct {
		// The port we call
		port string
		// The actual type of traffic we send to the port
		scheme scheme.Instance
	}