"istio.io/test-exclude-namespace": "true",
		},
	})
	if err != nil {
		return err
	}

	prom, err = prometheus.New(t, prometheus.Config{})
	if err != nil {
		return err
	}

	// Headless services don't work with targetPort, set to same port
	headlessPorts := make([]echo.Port, len(ports.All()))
	for i, p := range ports.All() {
		p.ServicePort = p.WorkloadPort
		headlessPorts[i] = p
	}

						Apply()

					echotest.New(t, apps.Ns1.All.Instances()).
						WithDefaultFilters(1, 1).
						FromMatch(match.NotProxylessGRPC).
						ToMatch(match.And(
							// TODO(nmittler): Why not headless/multiversion?
							match.NotHeadless,
							match.NotMultiVersion,
							match.NotNaked,
							match.NotProxylessGRPC)).
						ConditionallyTo(echotest.NoSelfCalls).

			cfg.ServiceLabels = make(map[string]string)
		}
		cfg.ServiceLabels[constants.AmbientUseWaypointLabel] = cfg.ServiceWaypointProxy
	}
	return map[string]any{
		"Service":        cfg.Service,
		"Headless":       cfg.Headless,
		"ServiceAccount": cfg.ServiceAccount,
		"ServicePorts":   cfg.Ports.GetServicePorts(),
		"ServiceLabels":  cfg.ServiceLabels,
		"IPFamilies":     cfg.IPFamilies,
		"IPFamilyPolicy": cfg.IPFamilyPolicy,

				log.Errorf("proxy is in cluster %v, but controller is for cluster %v", proxy.Metadata.ClusterID, c.Cluster())
				return nil
			}

			// 1. find proxy service by label selector, if not any, there may exist headless service without selector
			// failover to 2
			allServices := c.services.List(pod.Namespace, klabels.Everything())
			if services := getPodServices(allServices, pod); len(services) > 0 {

	MulticlusterHeadlessEnabled = env.Register("ENABLE_MULTICLUSTER_HEADLESS", true,
		"If true, the DNS name table for a headless service will resolve to same-network endpoints in any cluster.").Get()

	ResolveHostnameGateways = env.Register("RESOLVE_HOSTNAME_GATEWAYS", true,

	kubeClient := vpm.Host.GetKubeClient()
	if kubeClient == nil {
		// Don't handle the controller/kubelet version skew check and fallback
		// to just checking the feature gates. This can happen if
		// we are in a standalone (headless) Kubelet
		return true, nil
	}

	adcHost, ok := vpm.Host.(volume.AttachDetachVolumeHost)
	if !ok {
		// Don't handle the controller/kubelet version skew check and fallback

		// `PILOT_ENABLE_HEADLESS_SERVICE_POD_LISTENERS` enabled (by default) and applicable to all that's needed, pilot will generate
		// an outbound listener for each pod in a headless service. There is thus no need to do a SNI match. It saves us from having to
		// generate expensive permutations of the host name just like RDS does..

			// Istio filters out cross-network endpoints.
			return checkReachedSourceNetworkOnly(result, allClusters)
		}

		if !dnsCaptureEnabled && to.Config().IsHeadless() {
			// Headless services rely on DNS resolution. If DNS capture is
			// enabled, DNS will return all endpoints in the mesh, which will
			// allow requests to go cross-cluster. Otherwise, k8s DNS will

To use Remote debugging with IntelliJ, replace above step 2 with following:

1. From `./operator/cmd/operator` path run
`
dlv debug --headless --listen=:2345 --api-version=2 -- server
`.

1. In IntelliJ, create a new Go Remote debug configuration with default settings.

  * A pod can specify its own Hostname and Subdomain via annotations (<code>pod.beta.kubernetes.io/hostname, pod.beta.kubernetes.io/subdomain)</code>. If the Subdomain matches the name of a [headless service](http://kubernetes.io/docs/user-guide/services/#headless-services) in the same namespace, a DNS A record is also created for the pod’s FQDN. More