}

	serviceDiscovery := aggregate.NewController(aggregate.Options{})
	se := serviceentry.NewController(
		configController,
		xdsUpdater,
		env.Watcher,
		serviceentry.WithClusterID(opts.ClusterID))
	// TODO allow passing in registry, for k8s, mem reigstry
	serviceDiscovery.AddRegistry(se)
	msd := memregistry.NewServiceDiscovery(opts.Services...)
	msd.XdsUpdater = xdsUpdater

				break
			}
			return err
		}

		if se, ok := t.(xml.StartElement); ok {
			switch se.Name.Local {
			case "Status":
				var st LegalHoldStatus
				if err = d.DecodeElement(&st, &se); err != nil {
					return err
				}
				l.Status = st
			default:
				return xml.UnmarshalError(fmt.Sprintf("expected element type <Status> but have <%s>", se.Name.Local))
			}
		}
	}
	return nil
}

			}
			cfg.ApplyOrFail(t)

			// create a unique SE per cluster
			for _, c := range t.Clusters().Configs() {
				t.ConfigKube(c).YAML(apps.Namespace.Name(), fmt.Sprintf(seTmpl, c.Name())).ApplyOrFail(t)
			}

			weTmpl := `
apiVersion: networking.istio.io/v1alpha3
kind: WorkloadEntry
metadata:
  name: se-cross-network-{{.testName}}
  labels:
    app: b

				Number:   80,
				Protocol: "HTTP",
				Name:     "http",
			}},
			SubjectAltNames: []string{"se-top"},
			Resolution:      networking.ServiceEntry_STATIC,
			Endpoints: []*networking.WorkloadEntry{{
				Address:        "1.1.1.1",
				ServiceAccount: "se-endpoint",
			}},
		},
	}
	seNONE := config.Config{
		Meta: config.Meta{
			Name:             "service-entry",

	if err != nil {
		return err
	}
	for _, se := range ses.Items {
		if se.Spec.Resolution != networking.ServiceEntry_NONE {
			continue
		}
		changed := false
		for _, p := range se.Spec.Ports {
			if p.TargetPort != 0 && p.Number != p.TargetPort {
				changed = true
			}
		}
		if changed {
			res := ObjectToInstance(se)
			messages.Add(msg.NewUpdateIncompatibility(res,

		}
		blockMark[b.ID] = true
		if b.Func != f {
			f.Fatalf("%s.Func=%s, want %s", b, b.Func.Name, f.Name)
		}

		for i, e := range b.Preds {
			if se := e.b.Succs[e.i]; se.b != b || se.i != i {
				f.Fatalf("block pred/succ not crosslinked correctly %d:%s %d:%s", i, b, se.i, se.b)
			}
		}
		for i, e := range b.Succs {
			if pe := e.b.Preds[e.i]; pe.b != b || pe.i != i {

		})
	}
}

func TestServiceEntryWorkloads(t *testing.T) {
	cases := []struct {
		name   string
		inputs []any
		se     *networkingclient.ServiceEntry
		result []*workloadapi.Workload
	}{
		{
			name:   "dns without endpoints",
			inputs: []any{},
			se: &networkingclient.ServiceEntry{
				ObjectMeta: metav1.ObjectMeta{
					Name:      "name",
					Namespace: "ns",
				},

      app: foo
  mtls:
    mode: DISABLE
  portLevelMtls:
    9000:
      mode: PERMISSIVE
---`
	sePort8000 := `
apiVersion: networking.istio.io/v1alpha3
kind: ServiceEntry
metadata:
 name: se
spec:
 hosts:
 - foo.bar
 endpoints:
 - address: 1.1.1.1
 location: MESH_INTERNAL
 resolution: STATIC
 ports:
 - name: http
   number: 8000
   protocol: HTTP
---`

	}
}

func newServiceExport() *unstructured.Unstructured {
	se := &mcsapi.ServiceExport{
		TypeMeta: metav1.TypeMeta{
			Kind:       "ServiceExport",
			APIVersion: mcs.MCSSchemeGroupVersion.String(),
		},
		ObjectMeta: metav1.ObjectMeta{
			Name:      serviceExportName,
			Namespace: serviceExportNamespace,
		},
	}
	return toUnstructured(se)
}

}

type stackExcerpt []stackFrame

type stackFrame struct {
	file string
	line int
}

var _ fmt.Stringer = stackExcerpt(nil)

func (se stackExcerpt) String() string {
	var sb strings.Builder
	sb.WriteString("[")
	for i, sf := range se {
		if i > 0 {
			sb.WriteString(", ")
		}
		sb.WriteString(sf.file)
		sb.WriteString(":")
		sb.WriteString(strconv.FormatInt(int64(sf.line), 10))
	}