Resource: protoconv.MessageToAny(b),
		})
	}

	// TODO: MeshConfig, current dynamic ProxyConfig (for this proxy), Networks

	if w.TypeUrl == gvk.ServiceEntry.String() {
		// Include 'synthetic' SE - but without the endpoints. Used to generate CDS, LDS.
		// EDS is pass-through.
		svcs := proxy.SidecarScope.Services()
		for _, s := range svcs {
			// Ignore services that are result of conversion from ServiceEntry.

				},
				err: nil,
			},
		},
		{
			name: "tls mode SIMPLE, with SANs specified in service entries",
			opts: &buildClusterOpts{
				mutable:         newTestCluster(),
				serviceAccounts: []string{"se-san.com"},
				serviceRegistry: provider.External,
			},
			tls: &networking.ClientTLSSettings{
				Mode:           networking.ClientTLSSettings_SIMPLE,
				CaCertificates: rootCert,

	s := xdsfake.NewFakeDiscoveryServer(t, xdsfake.FakeOptions{
		ConfigString: mustReadFile(t, "tests/testdata/config/destination-rule-all.yaml") +
			mustReadFile(t, "tests/testdata/config/static-weighted-se.yaml"),
	})
	ads := s.Connect(nil, nil, watchAll)
	t.Run("Full Push", func(t *testing.T) {
		s.Discovery.Push(&model.PushRequest{Full: true})
		if _, err := ads.Wait(time.Second*5, watchAll...); err != nil {
			t.Fatal(err)

MTIyMDEyMzRaFw0zMDA4MTAyMDEyMzRaMFQxCzAJBgNVBAYTAlVTMQ8wDQYDVQQI
DAZEZW5pYWwxDjAMBgNVBAcMBUV0aGVyMQwwCgYDVQQKDANEaXMxFjAUBgNVBAMM
DSouZXhhbXBsZS5jb20wggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQDC
se+/CHI6gNhoj2pW/iawYaZT+FavNBwKq9y8+jQKp8ZSQvF0+44KWWTu258I/xxK
agJpXITOieCuLOHxsw2iMCgHz8US3cuAm3trvVG5se4ksEzBKXEqUtr4x7j25zUr
6r3JNQ1S51zIthc85ZchZFkS82T7uEgpYF5mDEbP7jlfZ/KVL/oquH1IJOjCufIU

			Equals(true, "{.useOriginalDst}").
			CheckOrFail(t)
	})

	t.Run("mongo", func(t *testing.T) {
		s := xds.NewFakeDiscoveryServer(t, xds.FakeOptions{
			ConfigString: mustReadFile(t, "tests/testdata/config/se-example.yaml"),
		})
		proxy := s.SetupProxy(&model.Proxy{
			IPAddresses: []string{"10.2.0.1"},
			ID:          "app3.testns",
		})
		structpath.ForProto(xdstest.ToDiscoveryResponse(s.Listeners(proxy))).

    - destination:
        host: "{{.Destination}}"
`).ApplyOrFail(t)

			cfg := config.YAML(`
{{ $to := .To }}
apiVersion: networking.istio.io/v1beta1
kind: ServiceEntry
metadata:
  name: test-se
spec:
  hosts:
  - serviceentry.istio.io # not used
  addresses:
  - 111.111.222.222
  ports:
  - number: 80
    name: http
    protocol: HTTP
  resolution: {{.Resolution}}

					}
					configObjects := `
---
apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
  name: subset-se
  namespace: test
spec:
  host: "*"
  subsets:
  - name: v1
    labels:
      version: v1
  - name: v2
    labels:
      version: v2
  - name: v3
    labels:
      version: v3
`

		skip: skip{
			skip:   true,
			reason: "not currently working, as SE doesn't have a VIP",
		},
		globalConfig: true,
		config: fmt.Sprintf(`apiVersion: v1
kind: Service
metadata:
  name: b-ext-se
spec:
  type: ExternalName
  externalName: %s`,
			t.Apps.External.All.Config().HostHeader()),
		children: calls("b-ext-se"),
	})

	gatewayListenPort := 80
	gatewayListenPortName := "http"

		service                  *model.Service
		port                     *model.Port
		proxyView                model.ProxyView
		destRule                 *networking.DestinationRule
		serviceAcct              []string // SE SAN values
		enableAutoSni            bool
		enableVerifyCertAtClient bool
		expectTLSContext         *tls.UpstreamTlsContext
	}{
		{

  namespace: istio-system
spec:
  mtls:
    mode: %s
`, m)
}

func TestInbound(t *testing.T) {
	svc := `
apiVersion: networking.istio.io/v1alpha3
kind: ServiceEntry
metadata:
  name: se
spec:
  hosts:
  - foo.bar
  endpoints:
  - address: 1.1.1.1
  location: MESH_INTERNAL
  resolution: STATIC
  ports:
  - name: tcp
    number: 70
    protocol: TCP
  - name: http