proxy: &Proxy{
				Labels:          map[string]string{"app": "v1"},
				Metadata:        &NodeMetadata{IstioVersion: "1.4.0", Labels: map[string]string{"app": "v1"}},
				ConfigNamespace: "istio-system",
			},
			expectedListenerPatches: 1,
			expectedClusterPatches:  1,
		},

		{
			name: "proxy matches no envoyfilter",
			proxy: &Proxy{
				Labels:          map[string]string{"app": "v2"},

                                    }
                                  },
                                  "shared_with_upstream": "ONCE",
                                  "factory_key": "envoy.string"
                                },
                                {
                                  "object_key": "io.istio.local_principal",
                                  "format_string": {

  google.protobuf.BoolValue enabled = 10;

  // Environment variables passed to the proxy container.
  google.protobuf.Struct env = 11;

  map<string, string> labels = 15;

  string loadBalancerIP = 16;

  repeated string loadBalancerSourceRanges = 17;

  string name = 44;

  // K8s node selector.
  //
  // See https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#nodeselector

		},
	}

	testNode := &model.Proxy{
		Labels: map[string]string{
			"app": "foo",
		},
		Metadata: &model.NodeMetadata{},
	}
	for _, tc := range cases {
		t.Run(tc.name, func(t *testing.T) {
			got := newPolicyApplier("root-namespace", nil, tc.peerPolicies, &model.PushContext{}).InboundMTLSSettings(
				8080,
				testNode,
				[]string{},
				NoOverride,
			)

	instancesByPort map[string]map[int][]*IstioEndpoint
}

func newServiceIndex() serviceIndex {
	return serviceIndex{
		public:               []*Service{},
		privateByNamespace:   map[string][]*Service{},
		exportedToNamespace:  map[string][]*Service{},
		HostnameAndNamespace: map[host.Name]map[string]*Service{},
		instancesByPort:      map[string]map[int][]*IstioEndpoint{},
	}
}

				Cert:               string(cert.ClientCert),
				Key:                string(cert.Key),
				CaCert:             string(cert.RootCert),
				InsecureSkipVerify: true,
			}
			hbsvc := echo.HBONE{
				Address:            apps.WaypointProxies[apps.ServiceAddressedWaypoint.Config().ServiceWaypointProxy].Inbound(),
				Headers:            nil,
				Cert:               string(cert.ClientCert),

            fieldRef:
              fieldPath: spec.nodeName
        - name: ISTIO_META_INTERCEPTION_MODE
          value: "{{ or (index .ObjectMeta.Annotations `sidecar.istio.io/interceptionMode`) .ProxyConfig.InterceptionMode.String }}"
        {{- if .Values.global.network }}
        - name: ISTIO_META_NETWORK
          value: "{{ .Values.global.network }}"
        {{- end }}
        {{- if .DeploymentMeta.Name }}

            fieldRef:
              fieldPath: spec.nodeName
        - name: ISTIO_META_INTERCEPTION_MODE
          value: "{{ or (index .ObjectMeta.Annotations `sidecar.istio.io/interceptionMode`) .ProxyConfig.InterceptionMode.String }}"
        {{- if .Values.global.network }}
        - name: ISTIO_META_NETWORK
          value: "{{ .Values.global.network }}"
        {{- end }}
        {{- if .DeploymentMeta.Name }}

            fieldRef:
              fieldPath: spec.nodeName
        - name: ISTIO_META_INTERCEPTION_MODE
          value: "{{ or (index .ObjectMeta.Annotations `sidecar.istio.io/interceptionMode`) .ProxyConfig.InterceptionMode.String }}"
        {{- if .Values.global.network }}
        - name: ISTIO_META_NETWORK
          value: "{{ .Values.global.network }}"
        {{- end }}
        {{- if .DeploymentMeta.Name }}

			log.Errorf("create envoyfilter failed %v", err)
		}
	}
	return store
}

func buildPatchStruct(config string) *structpb.Struct {
	val := &structpb.Struct{}
	_ = protomarshal.UnmarshalString(config, val)
	return val
}

// nolint: unparam
func buildGolangPatchStruct(config string) *structpb.Struct {
	val := &structpb.Struct{}
	_ = protomarshal.Unmarshal([]byte(config), val)
	return val
}