},
	}

	sidecarOutboundIn := []*cluster.Cluster{
		{
			Name:            "outbound|443||cluster1",
			DnsLookupFamily: cluster.Cluster_V4_ONLY,
			LbPolicy:        cluster.Cluster_ROUND_ROBIN,
			TransportSocketMatches: []*cluster.Cluster_TransportSocketMatch{
				{
					Name: "tlsMode-istio",
					TransportSocket: &core.TransportSocket{
						Name: "envoy.transport_sockets.tls",

				t.Errorf("Expected TransportSocket %v", test.expectTransportSocket)
			}
			if test.expectTransportSocketMatch && cluster.TransportSocketMatches == nil ||
				!test.expectTransportSocketMatch && cluster.TransportSocketMatches != nil {
				t.Errorf("Expected TransportSocketMatch %v", test.expectTransportSocketMatch)
			}
			upstreamProxyProtocol := &proxyprotocol.ProxyProtocolUpstreamTransport{}

				},
				defaultTransportSocketMatch(),
			}
		} else {
			if c.TransportSocket == nil {
				c.TransportSocketMatches = hboneOrPlaintextSocket
			} else {
				ts := c.TransportSocket
				c.TransportSocket = nil

				c.TransportSocketMatches = []*cluster.Cluster_TransportSocketMatch{
					hboneTransportSocket,
					{
						Name:            "tlsMode-" + model.IstioMutualTLSModeLabel,
						TransportSocket: ts,

	// Upstream of the "encap" listener.
	clusters = append(clusters, cb.buildWaypointConnectOriginate(proxy, push))

	for _, c := range clusters {
		if c.TransportSocket != nil && c.TransportSocketMatches != nil {
			log.Errorf("invalid cluster, multiple matches: %v", c.Name)
		}
	}
	return clusters
}

// `inbound-vip||hostname|port`. EDS routing to the internal listener for each pod in the VIP.

	resourceNames := sets.New[string]()
	var sockets []*core.TransportSocket
	if c.TransportSocket != nil {
		sockets = append(sockets, c.TransportSocket)
	}
	for _, ts := range c.TransportSocketMatches {
		sockets = append(sockets, ts.TransportSocket)
	}
	for _, s := range sockets {
		if s.GetTypedConfig().TypeUrl != TypeName[*tls.UpstreamTlsContext]() {
			continue
		}

		t.Errorf("cluster %v is invalid: %v", c.Name, err)
	}
	validateClusterTLS(t, c)
}

func validateClusterTLS(t testing.TB, c *cluster.Cluster) {
	if c.TransportSocket != nil && c.TransportSocketMatches != nil {
		t.Errorf("both transport_socket and transport_socket_matches set for %v", c)
	}
}

func ValidateRoutes(t testing.TB, ls []*route.Route) {
	for _, l := range ls {
		ValidateRoute(t, l)
	}

				t.Errorf("Expected TransportSocket %v", test.expectTransportSocket)
			}
			if test.expectTransportSocketMatch && opts.mutable.cluster.TransportSocketMatches == nil ||
				!test.expectTransportSocketMatch && opts.mutable.cluster.TransportSocketMatches != nil {
				t.Errorf("Expected TransportSocketMatch %v", test.expectTransportSocketMatch)
			}

			if test.validateTLSContext != nil {

				TransportSocket: c.cluster.TransportSocket,
			})},
		}
	}

	// add an upstream proxy protocol wrapper for each transportSocket
	for _, tsm := range c.cluster.TransportSocketMatches {
		tsm.TransportSocket = &core.TransportSocket{
			Name: "envoy.transport_sockets.upstream_proxy_protocol",

	g.Expect(tlsContext).ToNot(BeNil())
	g.Expect(tlsContext.GetSni()).To(Equal("custom.sni.com"))
	g.Expect(clusters[1].TransportSocketMatches).To(HaveLen(0))

	for _, i := range []int{0, 2, 3} {
		g.Expect(getTLSContext(t, clusters[i])).To(BeNil())
		g.Expect(clusters[i].TransportSocketMatches).To(HaveLen(2))
	}
}

func TestAutoMTLSClusterIgnoreWorkloadLevelPeerAuthn(t *testing.T) {
	g := NewWithT(t)