if err != nil {
		t.Fatal(err)
	}
	img2, err := mutate.Append(empty.Image, mutate.Addendum{Layer: l})
	if err != nil {
		t.Fatal(err)
	}

	// Set manifest type so it will pass the docker parsing branch.
	img2 = mutate.MediaType(img2, types.OCIManifestSchema1)

	d, _ = img2.Digest()
	invalidOCIImageDigest = d.Hex

	// Push image to the registry.
	err = crane.Push(img2, ref, fetchOpt)
	if err != nil {

		hosts = fmt.Sprintf("%s %s\n", ingressIP, IstiodHost(istioNamespace, revision))
	} else {
		log.Warnf("Could not auto-detect IP for %s/%s. Use --ingressIP to manually specify the Gateway address to reach istiod from the VM.",
			IstiodHost(istioNamespace, revision), istioNamespace)
	}
	return os.WriteFile(filepath.Join(dir, "hosts"), []byte(hosts), filePerms)
}

func isRevisioned(revision string) bool {

			}
		case *networking.HTTPFaultInjection_Abort_GrpcStatus:
			// We wouldn't have an unknown gRPC code here. This is because
			// the validation webhook would have already caught the invalid
			// code and we wouldn't reach here.
			out.Abort.ErrorType = &xdshttpfault.FaultAbort_GrpcStatus{
				GrpcStatus: uint32(grpc.SupportedGRPCStatus[a.GrpcStatus]),
			}
		default:
			log.Warnf("Only HTTP and gRPC type abort faults are supported")

func BenchmarkAnalyzers(b *testing.B) {
	for _, tc := range testGrid {
		tc := tc // Capture range variable so subtests work correctly
		b.Run(tc.name+"-bench", func(b *testing.B) {
			sa, err := setupAnalyzerForCase(tc, nil)
			if err != nil {
				b.Fatalf("Error setting up analysis for benchmark on testcase %s: %v", tc.name, err)
			}

			b.ResetTimer()

				statusCode int
				from       echo.Instances
			}{
				{
					name:       "workloads in SE configured namespace can reach external service",
					statusCode: http.StatusOK,
					from:       apps.NS[1].A,
				},
				{
					name:       "workloads in non-SE configured namespace, but same usergroup can reach external service",
					statusCode: http.StatusOK,
					from:       apps.NS[2].A,
				},
				{

// resources inside each config cluster rather than doing cross-cluster discovery via remote secret.
// Each case tests a different way of using local resources to reach remote destination(s).
func TestWorkloadEntryGateway(t *testing.T) {
	// nolint: staticcheck
	framework.NewTest(t).
		RequiresMinClusters(2).
		Run(func(t framework.TestContext) {
			crd.DeployGatewayAPIOrSkip(t)

	// If needed, the remaining pieces of metadata can be added to the static env var (missing is the gce_* ones).
	if len(GCPStaticMetadata) != 0 {
		return GCPStaticMetadata
	}
	// If we cannot reach the metadata server, bail out with only statically defined metadata
	fillMetadata := e.shouldFillMetadata()
	if !fillMetadata {
		return nil
	}

	e.Lock()
	defer e.Unlock()

	// TODO for now, we leave mTLS *off* by default:
	// 1. We don't know if the client uses xds.NewClientCredentials; these settings will be ignored if not
	// 2. We cannot reach servers in PERMISSIVE mode; gRPC doesn't allow us to override the alpn to one of Istio's

	// TODO(mathetake): have "Anonymous" option?
	if opt.useDefaultKeyChain() {
		// Note that default key chain reads the docker config from DOCKER_CONFIG
		// so must set the envvar when reaching this branch is expected.
		fetchOpts = append(fetchOpts, remote.WithAuthFromKeychain(authn.DefaultKeychain))
	} else {
		fetchOpts = append(fetchOpts, remote.WithAuthFromKeychain(&wasmKeyChain{data: opt.PullSecret}))
	}

  oneof destination {
    // TODO: add support for hostname lookup
    NamespacedHostname hostname = 1;
    NetworkAddress address = 2;
  }
  // port to reach the gateway at for mTLS HBONE connections
  uint32 hbone_mtls_port = 3;
  reserved "hbone_single_tls_port";
  reserved 4;
}

// NetworkAddress represents an address bound to a specific network.