return config
			},
			expectedEnabledAPIs: map[schema.GroupVersionResource]bool{
				extensionsapiv1beta1.SchemeGroupVersion.WithResource("ingresses"):   false, // this becomes false because the DisableVersions set in the defaultConfig is now order dependent.
				extensionsapiv1beta1.SchemeGroupVersion.WithResource("deployments"): false,
				extensionsapiv1beta1.SchemeGroupVersion.WithResource("replicasets"): false,

		return err
	}
	if err != nil {
		// not found
		return nil
	}
	// found
	res := ObjectToInstance(svc)
	messages.Add(msg.NewUpdateIncompatibility(res,
		"meshConfig.defaultConfig.tracer", "1.21",
		"tracing is no longer by default enabled to send to 'zipkin.istio-system.svc'; "+
			"follow https://istio.io/latest/docs/tasks/observability/distributed-tracing/telemetry-api/",
		"1.21"))
	return nil

	// Note that this setting may be configured different for each proxy, due user overrides
	// or from different versions of proxies connecting. While Pilot has access to the meshConfig.defaultConfig,
	// this field should be preferred if it is present.
	ProxyConfig *NodeMetaProxyConfig `json:"PROXY_CONFIG,omitempty"`

	// IstioVersion specifies the Istio version associated with the proxy

		}
	}

	out, err := yaml.Marshal(iop)
	if err != nil {
		return "", err
	}

	return string(out), nil
}

var defaultSetFlagConvertPaths = []string{
	"meshConfig.defaultConfig.proxyMetadata",
}

// convertDefaultIOPMapValues converts default map[string]string values into string.
func convertDefaultIOPMapValues(outYAML string, setFlags []string) (string, error) {

			},
		})
}

func fakeOptsWithDefaultProviders() gatewayListenerOpts {
	var opts gatewayListenerOpts
	opts.push = &model.PushContext{
		Mesh: &meshconfig.MeshConfig{
			EnableTracing: true,
			DefaultConfig: &meshconfig.ProxyConfig{
				Tracing: &meshconfig.Tracing{
					Sampling: 55.5,
				},
			},
			DefaultProviders: &meshconfig.MeshConfig_DefaultProviders{
				Tracing: []string{
					"foo",
				},

	SkipIstioMXHeaders         bool
}

func GetProxyHeaders(node *model.Proxy, push *model.PushContext, class istionetworking.ListenerClass) ProxyHeaders {
	pc := node.Metadata.ProxyConfigOrDefault(push.Mesh.DefaultConfig)
	return GetProxyHeadersFromProxyConfig(pc, class)
}

func GetProxyHeadersFromProxyConfig(pc *meshconfig.ProxyConfig, class istionetworking.ListenerClass) ProxyHeaders {
	base := ProxyHeaders{

	if cfg.EnableCNI {
		args.AppendSet("components.cni.enabled", "true")
	}

	if ctx.Settings().EnableDualStack {
		args.AppendSet("values.pilot.env.ISTIO_DUAL_STACK", "true")
		args.AppendSet("meshConfig.defaultConfig.proxyMetadata.ISTIO_DUAL_STACK", "true")
		args.AppendSet("values.gateways.istio-ingressgateway.ipFamilyPolicy", "RequireDualStack")
		args.AppendSet("values.gateways.istio-egressgateway.ipFamilyPolicy", "RequireDualStack")
	}

		t.Error("expected an error on an empty mesh config")
	}

	invalid := &meshconfig.MeshConfig{
		ProxyListenPort:    0,
		ConnectTimeout:     durationpb.New(-1 * time.Second),
		DefaultConfig:      &meshconfig.ProxyConfig{},
		TrustDomain:        "",
		TrustDomainAliases: []string{"a.$b", "a/b", ""},
		ExtensionProviders: []*meshconfig.MeshConfig_ExtensionProvider{
			{
				Name: "default",

	innerTranscript hash.Hash
	kdfID           uint16
	aeadID          uint16
	echRejected     bool
}

func (c *Conn) clientHandshake(ctx context.Context) (err error) {
	if c.config == nil {
		c.config = defaultConfig()
	}

	// This may be a renegotiation handshake, in which case some fields
	// need to be reset.
	c.didResume = false

	hello, keyShareKeys, ech, err := c.makeClientHello()
	if err != nil {

	// Mutable objects keyed by listener name so that we can build listeners at the end.
	mutableopts := make(map[string]mutableListenerOpts)
	proxyConfig := builder.node.Metadata.ProxyConfigOrDefault(builder.push.Mesh.DefaultConfig)
	// listener port -> host/bind
	tlsHostsByPort := map[uint32]map[string]string{}
	for _, port := range mergedGateway.ServerPorts {