tests := []struct {
		hostname string
		want     string
	}{
		{
			"foo.ns.svc.cluster.local",
			"ns",
		},
		{
			"foo.svc.cluster.local",
			"",
		},
		{
			"svc.ns.svc.svc.svc",
			"ns",
		},
		{
			".svc.",
			"",
		},
		{
			"..svc.",
			"",
		},
		{
			"x.svc.",
			"",
		},
	}
	for _, tt := range tests {

        prefix: /foo/
    name: default.grpc.0
    route:
    - destination:
        host: httpbin.default.svc.domain.suffix
        port:
          number: 80
  - match:
    - uri:
        regex: /[^/]+/bar
    name: default.grpc.1
    route:
    - destination:
        host: httpbin.default.svc.domain.suffix
        port:
          number: 80
---
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService

            - mesh
          port: 80
      route:
        - destination:
            host: "{{ .EgressGatewayServiceName | default "istio-egressgateway" }}.{{ .EgressGatewayServiceNamespace | default .SystemNamespace.Name }}.svc.cluster.local"
            port:
              number: 80
          weight: 100
    - match:
        - gateways:
            - test-egress
          port: 80
      route:
        - destination:

    value:
      stringMatch:
        prefix: istio-ext-authz
  grpcService:
    envoyGrpc:
      authority: my-custom-ext-authz.foo.svc.cluster.local
      clusterName: outbound|9000||my-custom-ext-authz.foo.svc.cluster.local
    timeout: 0.002s
  statusOnError:
    code: Forbidden
  transportApiVersion: V3
  withRequestBody:
    allowPartialMessage: true

		doLabel := func(labels map[string]string) error {
			// update needs the latest version
			svc, err := c.Kube().CoreV1().Services(ns.Name()).Get(t.Context(), service, metav1.GetOptions{})
			if err != nil {
				return err
			}
			svc.ObjectMeta.SetLabels(labels)
			_, err = c.Kube().CoreV1().Services(ns.Name()).Update(t.Context(), svc, metav1.UpdateOptions{})
			return err
		}

		if err = doLabel(newLabels); err != nil {

apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  annotations:
    internal.istio.io/gateway-semantics: gateway
    internal.istio.io/gateway-service: isolation-istio.gateway-conformance-infra.svc.domain.suffix
    internal.istio.io/parents: Gateway/isolation/empty-hostname.gateway-conformance-infra
  creationTimestamp: null
  name: isolation-istio-autogenerated-k8s-gateway-empty-hostname
  namespace: gateway-conformance-infra
spec:

		size += len(mergedDR.GetFrom())
	}
	configs := make([]model.ConfigHash, 0, size)
	for _, svc := range r.Services {
		configs = append(configs, model.ConfigKey{
			Kind:      kind.ServiceEntry,
			Name:      string(svc.Hostname),
			Namespace: svc.Attributes.Namespace,
		}.HashCode())
		for _, alias := range svc.Attributes.Aliases {

        hosts:
{{- range $svc := .Services }}
        - "example.{{ $svc.ServiceName }}.com"
{{- end }}
    from:
    - source:
        requestPrincipals: ["******@****.***/sub-1"]
    - source:
        requestPrincipals: ["******@****.***/sub-1"]
  - to:
    - operation:
        hosts:
  {{- range $svc := .Services }}
        - "any-request-principal-ok.{{ $svc.ServiceName }}.com"
  {{- end }}

apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  annotations:
    internal.istio.io/gateway-semantics: gateway
    internal.istio.io/gateway-service: eastwestgateway-istio.istio-system.svc.domain.suffix
    internal.istio.io/parents: Gateway/eastwestgateway/istiod-grpc.istio-system
  creationTimestamp: null
  name: eastwestgateway-istio-autogenerated-k8s-gateway-istiod-grpc
  namespace: istio-system
spec:
  servers:
  - hosts:

    value:
      stringMatch:
        prefix: istio-ext-authz
  grpcService:
    envoyGrpc:
      authority: my-custom-ext-authz.foo.svc.cluster.local
      clusterName: outbound|9000||my-custom-ext-authz.foo.svc.cluster.local
    timeout: 0.002s
  statusOnError:
    code: Forbidden
  transportApiVersion: V3
  withRequestBody:
    allowPartialMessage: true