spec:
  ports:
    -
      name: http
      port: 9080`
	validPortNamingSvc = `
apiVersion: v1
kind: Service
metadata:
  name: hello
spec:
  ports:
    - name: http
      port: 9080`
	validPortNamingWithSuffixSvc = `
apiVersion: v1
kind: Service
metadata:
  name: hello
spec:
  ports:
    - name: http-hello
      port: 9080`
	invalidPortNamingSvc = `
apiVersion: v1

// Exposed for testing constants
var (
	CNIBinDir          = "/opt/cni/bin"
	HostCNIBinDir      = "/host/opt/cni/bin"
	ServiceAccountPath = "/var/run/secrets/kubernetes.io/serviceaccount"
	// Well-known subpath we will mount any needed host-mounts under,
	// to preclude shadowing or breaking any pod-internal mounts
	HostMountsPath = "/host"

	"istio.io/istio/pilot/pkg/networking/util"
)

type EndpointFilter struct {
	Address string
	Port    uint32
	Cluster string
	Status  string
}

// Verify returns true if the passed host matches the filter fields
func (e *EndpointFilter) Verify(ep *endpoint.LbEndpoint, cluster string) bool {
	if e.Address == "" && e.Port == 0 && e.Cluster == "" && e.Status == "" {
		return true
	}

import (
	"fmt"
	"net/url"
	"strings"
)

func isMCPAddr(u *url.URL) bool {
	return strings.HasSuffix(u.Host, ".googleapis.com") || strings.HasSuffix(u.Host, ".googleapis.com:443")
}

func parseMCPAddr(u *url.URL) (*xdsAddr, error) {
	ret := &xdsAddr{host: u.Host}
	if !strings.HasSuffix(ret.host, ":443") {
		ret.host += ":443"
	}
	const projSeg = "/projects/"
	i := strings.Index(u.Path, projSeg)
	if i == -1 {

	if err != nil {
		return fmt.Errorf("could not build port forwarder for prometheus: %v", err)
	}

	if err = fw.Start(); err != nil {
		return fmt.Errorf("failure running port forward process: %v", err)
	}

	// Close the forwarder either when we exit or when an this processes is interrupted.
	defer fw.Close()
	dashboard.ClosePortForwarderOnInterrupt(fw)

	log.Debugf("port-forward to prometheus pod ready")

		for _, hostname := range vs.Spec.Hosts {
			if host.Name(hostname).IsWildCarded() {
				res := ObjectToInstance(vs)
				messages.Add(msg.NewUpdateIncompatibility(res,
					"PERSIST_OLDEST_FIRST_HEURISTIC_FOR_VIRTUAL_SERVICE_HOST_MATCHING", "1.20",
					"previously, VirtualServices with overlapping wildcard hosts would have the oldest "+
						"VirtualService take precedence. Now, the most specific VirtualService will win", "1.20"),
				)

		SkipTLSVerify:      viper.GetBool(constants.SkipTLSVerify),
		K8sServiceProtocol: os.Getenv("KUBERNETES_SERVICE_PROTOCOL"),
		K8sServiceHost:     os.Getenv("KUBERNETES_SERVICE_HOST"),
		K8sServicePort:     os.Getenv("KUBERNETES_SERVICE_PORT"),
		K8sNodeName:        os.Getenv("KUBERNETES_NODE_NAME"),

		CNIBinSourceDir:   constants.CNIBinDir,
		CNIBinTargetDirs:  []string{constants.HostCNIBinDir},

func createKubeConfig(cfg *config.InstallConfig) (kubeconfig, error) {
	if len(cfg.K8sServiceHost) == 0 {
		return kubeconfig{}, fmt.Errorf("KUBERNETES_SERVICE_HOST not set. Is this not running within a pod?")
	}

	if len(cfg.K8sServicePort) == 0 {
		return kubeconfig{}, fmt.Errorf("KUBERNETES_SERVICE_PORT not set. Is this not running within a pod?")
	}

	protocol := model.GetOrDefault(cfg.K8sServiceProtocol, "https")
	cluster := &api.Cluster{

	HostProbeSNATIPV6 = netip.MustParseAddr(env.RegisterStringVar("HOST_PROBE_SNAT_IPV6", DefaultHostProbeSNATIPV6, "").Get())
)

const (
	// to reliably identify kubelet healthprobes from inside the pod (versus standard kube-proxy traffic,
	// since the IP is normally the same), we SNAT identified host probes in the host netns to a fixed
	// APIPA/"link-local" IP.

	"istio.io/istio/pkg/log"
	"istio.io/istio/pkg/monitoring"
	"istio.io/istio/pkg/network"
)

func SetupMonitoring(port int, path string, stop <-chan struct{}) {
	if port <= 0 {
		return
	}
	mux := http.NewServeMux()
	var listener net.Listener
	var err error
	if listener, err = net.Listen("tcp", fmt.Sprintf(":%d", port)); err != nil {
		log.Errorf("unable to listen on socket: %v", err)
		return
	}