// ForwardEcho executes specific call from this workload.
	// TODO(nmittler): Instead of this, we should just make Workload implement Caller.
	ForwardEcho(context.Context, *proto.ForwardEchoRequest) (echo.Responses, error)

	// Logs returns the logs for the app container
	Logs() (string, error)
	LogsOrFail(t test.Failer) string
}

type Workloads []Workload

func (ws Workloads) Len() int {
	return len(ws)
}

			staticCluster: "",
			updateCluster: "",
		},
	})

	// Expect that we send an EDS response even though there was no request
	resp := ads.ExpectResponse()
	if resp.TypeUrl != v3.EndpointType {
		t.Fatalf("unexpected response type %v. Expected dependent EDS response", resp.TypeUrl)
	}
	// we must NOT get the cluster back

	t.Helper()
	checker := func(result echo.CallResult, inErr error) error {
		// Check that each response saw one of the workload IPs for the src echo instance
		for _, r := range result.Responses {
			found := false
			for _, ip := range expected {
				if r.IP == ip {
					found = true
				}
			}
			if !found {

		if err != nil {
			aggErr = multierror.Append(aggErr, err)
			continue
		}
		resps = append(resps, out.Responses...)
	}
	if aggErr.ErrorOrNil() != nil {
		return echo.CallResult{}, aggErr
	}

	return echo.CallResult{
		From:      c,
		Opts:      opts,
		Responses: resps,
	}, nil

				"x-envoy-peer-metadata-id",
				// Tracing decorator. We may consider disabling this if tracing is off?
				"x-envoy-decorator-operation",
			)

			checkNoProxyHeaders := check.Each(func(response echoClient.Response) error {
				for k, v := range response.RequestHeaders {
					hn := strings.ToLower(k)
					if allowedClientHeaders.Contains(hn) {
						// This is allowed
						continue
					}

	// TCP settings.
	TCP TCP

	// TLS settings.
	TLS TLS

	// HBONE settings.
	HBONE HBONE

	// Message to be sent.
	Message string

	// Check the server responses. If none is provided, only the number of responses received
	// will be checked.
	Check Checker

	// If we have been asked to do TCP comms with a PROXY protocol header,
	// determine which version (1 or 2), and send the header.

	if notExpected > 0 {
		notExpectedStr = strconv.Itoa(notExpected)
	}
	return func(r echoClient.Response) error {
		if r.Code == notExpectedStr {
			return fmt.Errorf("received unexpected response code `%s`. Response: %s", notExpectedStr, r)
		}
		return nil
	}
}

// GRPCStatus checks that the gRPC response status code matches the expected value.
func GRPCStatus(expected codes.Code) echo.Checker {

		}
		got := map[string]int{}
		for _, r := range result.Responses {
			// Hostname will take form of svc-v1-random. We want to extract just 'svc'
			parts := strings.SplitN(r.Hostname, "-", 2)
			if len(parts) < 2 {
				return fmt.Errorf("unexpected hostname: %v", r)
			}
			gotHost := parts[0]
			got[gotHost]++
		}
		scopes.Framework.Infof("Got responses: %+v", got)
		for svc, reqs := range got {

// TODO: support WorkloadEntry - to generate endpoints (equivalent with EDS)
// TODO: based on lessons from MCP, we want to send 'chunked' responses, like apiserver does.
// A first attempt added a 'sync' record at the end. Based on feedback and common use, a
// different approach can be used - for large responses, we can mark the last one as 'hasMore'
// by adding a field to the envelope.

		case resp := <-con.deltaResponsesChan:
			// TODO: separate upstream response handling from requests sending, which are both time costly
			proxyLog.WithLabels(
				"id", con.conID,
				"type", model.GetShortType(resp.TypeUrl),
				"nonce", resp.Nonce,
				"resources", len(resp.Resources),
				"removes", len(resp.RemovedResources),
			).Debugf("upstream response")
			metrics.XdsProxyResponses.Increment()