selector:
    matchLabels:
      app: foo
  mtls:
    mode: DISABLE
  portLevelMtls:
    9000:
      mode: PERMISSIVE
---`
	sePort8000 := `
apiVersion: networking.istio.io/v1alpha3
kind: ServiceEntry
metadata:
 name: se
spec:
 hosts:
 - foo.bar
 endpoints:
 - address: 1.1.1.1
 location: MESH_INTERNAL
 resolution: STATIC
 ports:
 - name: http
   number: 8000
   protocol: HTTP

		return config.Config{
			Meta: config.Meta{
				Name:             "service",
				Namespace:        "default",
				GroupVersionKind: gvk.ServiceEntry,
			},
			Spec: &networking.ServiceEntry{
				Hosts: []string{"foo.com"},
				Ports: []*networking.ServicePort{{
					Number:   80,
					Protocol: "HTTP",
					Name:     "http",
				}},

	Service                        = schema.GroupVersionResource{Group: "", Version: "v1", Resource: "services"}
	ServiceAccount                 = schema.GroupVersionResource{Group: "", Version: "v1", Resource: "serviceaccounts"}
	ServiceEntry                   = schema.GroupVersionResource{Group: "networking.istio.io", Version: "v1alpha3", Resource: "serviceentries"}

  namespace: test
spec:
  ports:
  - port: 80
    protocol: TCP
  selector:
    app: remote-we-svc
`,
		},
		{
			name: "ServiceEntry",
			cfg: `
---
apiVersion: networking.istio.io/v1alpha3
kind: ServiceEntry
metadata:
  name: remote-we-svc
  namespace: test
spec:
  hosts:
  - remote-we-svc
  ports:
    - number: 80
      name: http

	serviceEntries := kclient.NewDelayedInformer[*networkingclient.ServiceEntry](options.Client,
		gvr.ServiceEntry, kubetypes.StandardInformer, filter)
	ServiceEntries := krt.WrapClient[*networkingclient.ServiceEntry](serviceEntries, krt.WithName("ServiceEntries"))

	workloadEntries := kclient.NewDelayedInformer[*networkingclient.WorkloadEntry](options.Client,

  //
  // cluster/group/kind/namespace/name/section-name
  //
  // As an example, a ServiceEntry with two WorkloadEntries inlined could become
  // two Workloads with the following UIDs:
  // - cluster1/networking.istio.io/v1alpha3/ServiceEntry/default/external-svc/endpoint1
  // - cluster1/networking.istio.io/v1alpha3/ServiceEntry/default/external-svc/endpoint2
  //

		return &k8sioapicorev1.Secret{}
	case gvr.Service:
		return &k8sioapicorev1.Service{}
	case gvr.ServiceAccount:
		return &k8sioapicorev1.ServiceAccount{}
	case gvr.ServiceEntry:
		return &apiistioioapinetworkingv1alpha3.ServiceEntry{}
	case gvr.Sidecar:
		return &apiistioioapinetworkingv1alpha3.Sidecar{}
	case gvr.StatefulSet:
		return &k8sioapiappsv1.StatefulSet{}
	case gvr.TCPRoute:

```mermaid
graph TD
    subgraph Kube Controller
        s(Services)
        e(Endpoints)
        p(Pods)
        ksi(ServiceInstances)
        kwi(WorkloadInstances)
        s-->ksi
        e-->ksi
        p-->kwi
    end
    subgraph ServiceEntry Controller
        se(ServiceEntry)
        we(WorkloadEntry)

	t.Cleanup(s.Shutdown)

	serviceHandler := func(_, curr *model.Service, _ model.Event) {
		pushReq := &model.PushRequest{
			Full:           true,
			ConfigsUpdated: sets.New(model.ConfigKey{Kind: kind.ServiceEntry, Name: string(curr.Hostname), Namespace: curr.Attributes.Namespace}),
			Reason:         model.NewReasonStats(model.ServiceUpdate),
		}
		s.ConfigUpdate(pushReq)
	}

	if opts.DefaultClusterName == "" {

		}
	})
	t.Run("Incremental Push with updated services", func(t *testing.T) {
		ads.WaitClear()
		s.Discovery.Push(&model.PushRequest{
			Full:           false,
			ConfigsUpdated: sets.New(model.ConfigKey{Kind: kind.ServiceEntry, Name: "destall.default.svc.cluster.local", Namespace: "testns"}),
		})
		if err := ads.WaitSingle(time.Second*5, v3.EndpointType, v3.ClusterType); err != nil {
			t.Fatal(err)
		}
	})