},
				err: nil,
			},
		},
		{
			name: "tls mode SIMPLE, with SANs specified in service entries",
			opts: &buildClusterOpts{
				mutable:         newTestCluster(),
				serviceAccounts: []string{"se-san.com"},
				serviceRegistry: provider.External,
			},
			tls: &networking.ClientTLSSettings{
				Mode:           networking.ClientTLSSettings_SIMPLE,
				CaCertificates: rootCert,

    - destination:
        host: "{{.Destination}}"
`).ApplyOrFail(t)

			cfg := config.YAML(`
{{ $to := .To }}
apiVersion: networking.istio.io/v1beta1
kind: ServiceEntry
metadata:
  name: test-se
spec:
  hosts:
  - serviceentry.istio.io # not used
  addresses:
  - 111.111.222.222
  ports:
  - number: 80
    name: http
    protocol: HTTP
  resolution: {{.Resolution}}

		skip: skip{
			skip:   true,
			reason: "not currently working, as SE doesn't have a VIP",
		},
		globalConfig: true,
		config: fmt.Sprintf(`apiVersion: v1
kind: Service
metadata:
  name: b-ext-se
spec:
  type: ExternalName
  externalName: %s`,
			t.Apps.External.All.Config().HostHeader()),
		children: calls("b-ext-se"),
	})

	gatewayListenPort := 80
	gatewayListenPortName := "http"

		service                  *model.Service
		port                     *model.Port
		proxyView                model.ProxyView
		destRule                 *networking.DestinationRule
		serviceAcct              []string // SE SAN values
		enableAutoSni            bool
		enableVerifyCertAtClient bool
		expectTLSContext         *tls.UpstreamTlsContext
	}{
		{

  namespace: istio-system
spec:
  mtls:
    mode: %s
`, m)
}

func TestInbound(t *testing.T) {
	svc := `
apiVersion: networking.istio.io/v1alpha3
kind: ServiceEntry
metadata:
  name: se
spec:
  hosts:
  - foo.bar
  endpoints:
  - address: 1.1.1.1
  location: MESH_INTERNAL
  resolution: STATIC
  ports:
  - name: tcp
    number: 70
    protocol: TCP
  - name: http

	for _, obj := range ses {
		if obj.Meta.Name == name {
			ns := obj.Meta.Namespace
			if ns == "" {
				ns = metav1.NamespaceDefault
			}
			if ns == namespace {
				se := obj.Spec.(*istio.ServiceEntry)
				return se.Hosts
			}
		}
	}
	return []string{}
}

func buildMeshAndGatewayRoutes[T any](parentRefs []routeParentReference, convertRules func(mesh bool) T) (T, T) {
	var meshResult, gwResult T