err := in.sleepWatchInstall(ctx, sets.String{})
			if err != nil {
				t.Fatalf("error should be nil due to invalid config, got: %v", err)
			}
			assert.Equal(t, isReady.Load(), false)

			if len(c.invalidConfigFilename) > 0 {
				if err := os.Remove(cniConfigFilepath); err != nil {
					t.Fatal(err)
				}
			}

			// Copy a valid config file into tempDir

   Matching subsets: 
      (Non-matching subsets v1)
   Traffic Policy TLS Mode: ISTIO_MUTUAL
   Policies: load balancer/connection pool/outlier detection
   Port Level Settings:
    8080:
      TLS Mode: DISABLE
      Policies: load balancer/connection pool/outlier detection
VirtualService: bookinfo
   Route to host "productpage" with weight 30%

    # the default MCP is assumed.
    configSource:
      subscribedResources: []

    # The following is used to limit how long a sidecar can be connected
    # to a pilot. It balances out load across pilot instances at the cost of
    # increasing system churn.
    keepaliveMaxServerConnectionAge: 30m

    # Additional labels to apply to the deployment.
    deploymentLabels: {}

    ## Mesh config settings

  repeated Ingress items = 2;
}

// IngressLoadBalancerIngress represents the status of a load-balancer ingress point.
message IngressLoadBalancerIngress {
  // ip is set for load-balancer ingress points that are IP based.
  // +optional
  optional string ip = 1;

  // hostname is set for load-balancer ingress points that are DNS based.
  // +optional
  optional string hostname = 2;

  repeated Ingress items = 2;
}

// IngressLoadBalancerIngress represents the status of a load-balancer ingress point.
message IngressLoadBalancerIngress {
  // ip is set for load-balancer ingress points that are IP based.
  // +optional
  optional string ip = 1;

  // hostname is set for load-balancer ingress points that are DNS based.
  // +optional
  optional string hostname = 2;

      ((n++))
      log "Command failed. Attempt $n/$max:"
      sleep $delay;
    else
      log "The command has failed after $n attempts."  >&2
      return 2
    fi
  done
}

# load_cluster_topology function reads cluster configuration topology file and
# sets up environment variables used by other functions. So this should be called
# before anything else.
#

          "showLineNumbers": false,
          "showMiniMap": false
        },

	err := netServer.RemovePodFromMesh(ctx, pod)
	assert.NoError(t, err)
	assert.Equal(t, ztunnelServer.deletedPods.Load(), 1)
	assert.Equal(t, nlDeps.DelInpodMarkIPRuleCnt.Load(), 1)
	assert.Equal(t, nlDeps.DelLoopbackRoutesCnt.Load(), 1)
	// make sure the uid was taken from cache and netns closed
	netns := fixture.podNsMap.Take(string(pod.UID))
	assert.Equal(t, nil, netns)

  repeated Ingress items = 2;
}

// IngressLoadBalancerIngress represents the status of a load-balancer ingress point.
message IngressLoadBalancerIngress {
  // IP is set for load-balancer ingress points that are IP based.
  // +optional
  optional string ip = 1;

  // Hostname is set for load-balancer ingress points that are DNS based.
  // +optional
  optional string hostname = 2;

        we-->swi
    end
    kwi-->ssi
    swi-->ksi
```

For the most part this is fairly straight forward. However, we support `ServiceEntry` selecting `Pod`, and `Service` selecting `WorkloadEntry`, which leads to cross-controller communication.

Note: the asymmetry with `Pods` not contributing to Kube controller's `ServiceInstances` is due to the use of `Endpoints` which itself is derived from `Pod` from Kubernetes core.