ns1/p1:
  k2: v2
ns1/p2:
  k1: v1
  k2: v2
  k3: v33
ns1/p3:
  k1: v1
  k2: v22
  k3: v3
ns1/p4:
  k1: v1
  k4: v4
`

	p1c1 = "ns1/d1/p1/c1"
	p1c2 = "ns1/d1/p1/c2"
	p2c3 = "ns1/d1/p2/c3"
	p3c4 = "ns1/d2/p3/c4"
	p3c5 = "ns1/d2/p3/c5"
	p4c6 = "ns1/d2/p4/c6"

	p1 = []string{p1c1, p1c2}
	p2 = []string{p2c3}
	p3 = []string{p3c4, p3c5}
	p4 = []string{p4c6}

		# svc1
		add chain ip kube-proxy service-ULMVA6XW-ns1/svc1/tcp/p80
		add rule ip kube-proxy service-ULMVA6XW-ns1/svc1/tcp/p80 ip daddr 172.30.0.41 tcp dport 80 ip saddr != 10.0.0.0/8 jump mark-for-masquerade
		add rule ip kube-proxy service-ULMVA6XW-ns1/svc1/tcp/p80 numgen random mod 1 vmap { 0 : goto endpoint-5OJB2KTY-ns1/svc1/tcp/p80__10.180.0.1/80 }

		add chain ip kube-proxy endpoint-5OJB2KTY-ns1/svc1/tcp/p80__10.180.0.1/80

  namespace: istio-config
spec:
  host: "*.local"
  trafficPolicy:
    tls:
      mode: ISTIO_MUTUAL
---
# Services and configs in ns1 namespace
apiVersion: networking.istio.io/v1alpha3
kind: ServiceEntry
metadata:
  name: http1
  namespace: ns1
spec:
  hosts:
  - http1.ns1.svc.cluster.local
  addresses:
  - 2.1.1.1
  ports:
  - number: 8081
    name: http
    protocol: HTTP2
  location: MESH_INTERNAL

	c.UpdateEndpointPortCache(types.NamespacedName{Namespace: "ns1", Name: "svc1"}, spCacheInefficient)
	expectNumEndpointsAndSlices(t, c, 2, 13, 30)

	c.UpdateEndpointPortCache(types.NamespacedName{Namespace: "ns1", Name: "svc2"}, spCacheEfficient)
	expectNumEndpointsAndSlices(t, c, 4, 15, 110)

	c.UpdateEndpointPortCache(types.NamespacedName{Namespace: "ns1", Name: "svc3"}, spCacheInefficient)
	expectNumEndpointsAndSlices(t, c, 6, 28, 140)

			expected: sets.New(
				"productpage.ns1.svc.cluster.local.", "productpage.", "productpage.ns1.svc.cluster.local", "productpage.ns1.", "productpage.ns1.svc.",
			),
		},
		{
			startsWith: "svc-with-alt",
			expected: sets.New(
				"svc-with-alt.",
				"svc-with-alt.ns1.",
				"svc-with-alt.ns1.svc.",
				"svc-with-alt.ns1.svc.clusterset.local.",
				"svc-with-alt.ns1.svc.cluster.local.",

			makeNSN("ns1", "ep1"): 1,
		},
		expectedChangedEndpoints: sets.New(makeNSN("ns1", "ep1")),
	}, {
		name: "remove a slice from an endpoint",
		previousEndpointSlices: []*discovery.EndpointSlice{
			makeTestEndpointSlice("ns1", "ep1", 1, multipleSubsets_s1),
			makeTestEndpointSlice("ns1", "ep1", 2, multipleSubsets_s2),
		},
		currentEndpointSlices: []*discovery.EndpointSlice{
			makeTestEndpointSlice("ns1", "ep1", 1, namedPort),

// e.g.:
// NamesForNamespace(["ns1/foo.com","ns2/bar.com"], "ns1")   = Names(["foo.com"])
// NamesForNamespace(["ns1/foo.com","ns2/bar.com"], "ns3")   = Names([])
// NamesForNamespace(["ns1/foo.com","*/bar.com"], "ns1")     = Names(["foo.com","bar.com"])
// NamesForNamespace(["ns1/foo.com","*/bar.com"], "ns3")     = Names(["bar.com"])

			namespacedName: types.NamespacedName{Name: "svc1", Namespace: "ns1"},
			endpointSlices: []*discovery.EndpointSlice{
				generateEndpointSlice("svc1", "ns1", 1, 3, 999, 999, []string{}, []*int32{ptr.To[int32](80)}),
				generateEndpointSlice("svc1", "ns1", 2, 3, 999, 999, []string{}, []*int32{ptr.To[int32](80)}),
			},
			expectedMap: map[ServicePortName][]*BaseEndpointInfo{
				makeServicePortName("ns1", "svc1", "port-0", v1.ProtocolTCP): {

			},
			roleBindings: []*rbacv1.RoleBinding{
				newRoleBinding("ns1", "admin", bindToClusterRole, "User:admin", "Group:admins"),
			},
			shouldPass: []authorizer.Attributes{
				&defaultAttributes{"admin", "", "get", "Pods", "", "ns1", ""},
				&defaultAttributes{"admin", "", "watch", "Pods", "", "ns1", ""},
				&defaultAttributes{"admin", "group1", "watch", "Foobar", "", "ns1", ""},

		}
		return item.refCount
	}
	assert.Equal(t, 3, refs("ns1", "s1"))
	assert.Equal(t, 1, refs("ns1", "s10"))
	assert.Equal(t, 3, refs("ns1", "s2"))
	assert.Equal(t, 3, refs("ns1", "s3"))
	assert.Equal(t, 2, refs("ns1", "s30"))
	assert.Equal(t, 2, refs("ns1", "s4"))
	assert.Equal(t, 4, refs("ns1", "s5"))
	assert.Equal(t, 2, refs("ns1", "s50"))
	assert.Equal(t, 0, refs("ns1", "s6"))
	assert.Equal(t, 0, refs("ns1", "s60"))