ProxyConfigs *ProxyConfigs `json:"-"`

	// The following data is either a global index or used in the inbound path.
	// Namespace specific views do not apply here.

	// Mesh configuration for the mesh.
	Mesh *meshconfig.MeshConfig `json:"-"`

	// PushVersion describes the push version this push context was computed for
	PushVersion string

	// LedgerVersion is the version of the configuration ledger

	listenPort int,
	mesh *meshconfig.MeshConfig,
	mostSpecificWildcardVsIndex map[host.Name]types.NamespacedName,
) []VirtualHostWrapper {
	meshGateway := sets.New(constants.IstioMeshGateway)
	opts := RouteOptions{
		// Sidecar is never terminating TLS
		IsTLS: false,
		// Sidecar is never doing H3 (yet)
		IsHTTP3AltSvcHeaderNeeded: false,
		Mesh:                      mesh,
	}

  //
  // If an administrator expects that any of these conditions may become true in
  // the future, they should ensure their meshes have different Mesh IDs
  // assigned.
  //
  // Within a multicluster mesh, each cluster must be (manually or auto)
  // configured to have the same Mesh ID value. If an existing cluster 'joins' a

			}
			gwMap[ref] = gwMap[alias]
		}

		reportGatewayStatus(r, obj, classInfo, gatewayServices, servers, err)
	}
	// Insert a parent for Mesh references.
	gwMap[meshParentKey] = []*parentInfo{
		{
			InternalName: "mesh",
			// Mesh has no configurable AllowedKinds, so allow all supported
			AllowedKinds: []k8s.RouteGroupKind{

			sidecar,
			nil,
			nil, // No Telemetry API configured, fall back to legacy mesh config setting
		},
		{
			"prometheus-mesh",
			[]config.Config{newTelemetry("istio-system", prometheus)},
			networking.ListenerClassSidecarOutbound,
			sidecar,
			nil,
			nil, // No Telemetry API configured, fall back to legacy mesh config setting
		},
		{
			"prometheus-namespace",

	"google.golang.org/protobuf/types/known/durationpb"
	wrappers "google.golang.org/protobuf/types/known/wrapperspb"

	extensions "istio.io/api/extensions/v1alpha1"
	meshconfig "istio.io/api/mesh/v1alpha1"
	networking "istio.io/api/networking/v1alpha3"
	security "istio.io/api/security/v1beta1"
	telemetry "istio.io/api/telemetry/v1alpha1"
	"istio.io/istio/pilot/pkg/features"
	"istio.io/istio/pilot/pkg/model"

	"k8s.io/apimachinery/pkg/api/resource"
	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
	"k8s.io/apimachinery/pkg/util/intstr"

	"istio.io/api/annotation"
	"istio.io/api/label"
	meshconfig "istio.io/api/mesh/v1alpha1"
	"istio.io/client-go/pkg/apis/networking/v1alpha3"
	"istio.io/istio/pilot/pkg/features"
	"istio.io/istio/pilot/pkg/model"
	"istio.io/istio/pilot/pkg/serviceregistry/kube"

spec:
  mtls:
    mode: STRICT
				`).ApplyOrFail(t)
				opt = opt.DeepCopy()
				if !src.Config().HasProxyCapabilities() && dst.Config().HasProxyCapabilities() {
					// Expect deny if the dest is in the mesh (enforcing mTLS) but src is not (not sending mTLS)
					opt.Check = CheckDeny
				}
				src.CallOrFail(t, opt)
			})
			// globally peerauth == STRICT, but we have a port-specific allowlist that is PERMISSIVE,

	kerrors "k8s.io/apimachinery/pkg/api/errors"
	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
	"k8s.io/apimachinery/pkg/util/intstr"
	"k8s.io/client-go/kubernetes"

	"istio.io/api/label"
	meshconfig "istio.io/api/mesh/v1alpha1"
	"istio.io/api/meta/v1alpha1"
	networking "istio.io/api/networking/v1alpha3"
	"istio.io/istio/pilot/pkg/config/memory"
	"istio.io/istio/pilot/pkg/features"
	"istio.io/istio/pilot/pkg/model"

	go configController.Run(stop)
	fx := xdsfake.NewFakeXDS()
	go func() {
		for {
			select {
			case <-stop:
				return
			case <-fx.Events: // drain
			}
		}
	}()

	meshcfg := mesh.NewFixedWatcher(mesh.DefaultMeshConfig())
	serviceController := NewController(configController, fx, meshcfg)
	return configController, serviceController
}