"protocol": "istio-peer-exchange"
                }
              }
            ],
            "transport_socket_matches": [
              {
                "name": "tlsMode-istio",
                "match": {
                  "tlsMode": "istio"
                },
                "transport_socket": {

				ts = tsm.GetTransportSocket()
				break
			}
		}
		if ts == nil {
			// If we merged we would get both a transport_socket and transport_socket_matches which is not valid
			// Drop the filter, but indicate that we handled the merge so that the outer function does not try
			// to merge it again
			return true, nil
		}
	} else if c.GetTransportSocket() != nil {

	}
	validateClusterTLS(t, c)
}

func validateClusterTLS(t testing.TB, c *cluster.Cluster) {
	if c.TransportSocket != nil && c.TransportSocketMatches != nil {
		t.Errorf("both transport_socket and transport_socket_matches set for %v", c)
	}
}

func ValidateRoutes(t testing.TB, ls []*route.Route) {
	for _, l := range ls {
		ValidateRoute(t, l)
	}
}

                                        "metadata": {
                                            "filter_metadata": {
                                                "envoy.transport_socket_match": {
                                                    "tlsMode": "istio"
                                                },
                                                "istio": {

                        },
                        "healthStatus": "HEALTHY",
                        "metadata": {
                            "filterMetadata": {
                                "envoy.transport_socket_match": {
                                    "tlsMode": "istio"
                                },
                                "istio": {

            address: 10.244.0.190
            portValue: 9080
        healthCheckConfig: {}
      healthStatus: HEALTHY
      loadBalancingWeight: 1
      metadata:
        filterMetadata:
          envoy.transport_socket_match:
            tlsMode: istio
          istio:
            workload: details-v1;default;details;v1;Kubernetes
    loadBalancingWeight: 1
    locality: {}
  policy:
    overprovisioningFactor: 140

				t.Errorf("Expected TransportSocket %v", test.expectTransportSocket)
			}
			if test.expectTransportSocketMatch && cluster.TransportSocketMatches == nil ||
				!test.expectTransportSocketMatch && cluster.TransportSocketMatches != nil {
				t.Errorf("Expected TransportSocketMatch %v", test.expectTransportSocketMatch)
			}
			upstreamProxyProtocol := &proxyprotocol.ProxyProtocolUpstreamTransport{}

				},
				defaultTransportSocketMatch(),
			}
		} else {
			if c.TransportSocket == nil {
				c.TransportSocketMatches = hboneOrPlaintextSocket
			} else {
				ts := c.TransportSocket
				c.TransportSocket = nil

				c.TransportSocketMatches = []*cluster.Cluster_TransportSocketMatch{
					hboneTransportSocket,
					{
						Name:            "tlsMode-" + model.IstioMutualTLSModeLabel,
						TransportSocket: ts,

		},
	}

	sidecarOutboundIn := []*cluster.Cluster{
		{
			Name:            "outbound|443||cluster1",
			DnsLookupFamily: cluster.Cluster_V4_ONLY,
			LbPolicy:        cluster.Cluster_ROUND_ROBIN,
			TransportSocketMatches: []*cluster.Cluster_TransportSocketMatch{
				{
					Name: "tlsMode-istio",
					TransportSocket: &core.TransportSocket{
						Name: "envoy.transport_sockets.tls",

	// Upstream of the "encap" listener.
	clusters = append(clusters, cb.buildWaypointConnectOriginate(proxy, push))

	for _, c := range clusters {
		if c.TransportSocket != nil && c.TransportSocketMatches != nil {
			log.Errorf("invalid cluster, multiple matches: %v", c.Name)
		}
	}
	return clusters
}

// `inbound-vip||hostname|port`. EDS routing to the internal listener for each pod in the VIP.