}
	eps := obj.(*api.Endpoints)
	if len(eps.Subsets) == 0 {
		return nil, nil, errors.NewServiceUnavailable(fmt.Sprintf("no endpoints available for service %q", svcName))
	}
	// Pick a random Subset to start searching from.
	ssSeed := rand.Intn(len(eps.Subsets))
	// Find a Subset that has the port.
	for ssi := 0; ssi < len(eps.Subsets); ssi++ {
		ss := &eps.Subsets[(ssSeed+ssi)%len(eps.Subsets)]
		if len(ss.Addresses) == 0 {
			continue

  hosts:
  - "%s"
`, apps.B.Config().ClusterLocalFQDN()))
					},
				},
				{
					"subsets",
					func(t framework.TestContext) {
						cfg := tmpl.EvaluateOrFail(t, `
apiVersion: networking.istio.io/v1beta1
kind: DestinationRule
metadata:
  name: mysvc-dr
spec:
  host: {{.host}}
  subsets:
{{- range .dst }}
  - name: {{ .Config.Cluster.Name }}
    labels:

	dr, ok := drc.Spec.(*networkingapi.DestinationRule)
	if !ok || dr == nil {
		return nil
	}

	if subset == "" {
		return trafficPolicyTLSModeForPort(dr.GetTrafficPolicy(), port)
	}

	for _, ss := range dr.Subsets {
		if ss.Name != subset {
			continue
		}
		return trafficPolicyTLSModeForPort(ss.GetTrafficPolicy(), port)
	}
	return nil
}

				TargetHost: "example.com",
				TargetPort: 8443,
			},
		},
	}
	tunnelingEnabledForSubset := &networking.DestinationRule{
		Host: "tunnel-proxy.com",
		Subsets: []*networking.Subset{
			{
				Name: "example-com-8443",
				TrafficPolicy: &networking.TrafficPolicy{
					Tunnel: &networking.TrafficPolicy_TunnelSettings{
						Protocol:   "POST",

	sp := &hcn.SubnetPolicy{
		Type: hcn.VSID,
	}
	sp.Settings = vsidJson

	spJson, err := json.Marshal(sp)
	if err != nil {
		return nil, err
	}

	network.Ipams[0].Subnets[0].Policies = append(network.Ipams[0].Subnets[0].Policies, spJson)

	return network.Create()

    }
  }

  /**
   * Returns the set of all possible subsets of {@code set}. For example, {@code
   * powerSet(ImmutableSet.of(1, 2))} returns the set {@code {{}, {1}, {2}, {1, 2}}}.
   *
   * <p>Elements appear in these subsets in the same iteration order as they appeared in the input
   * set. The order in which these subsets appear in the outer set is undefined. Note that the power

				"mountPath": "/etc/certs"
			}
		}
	`

	var customConfig []echo.Config

	client := echo.Config{
		Service:   "client",
		Namespace: appsNamespace,
		Ports:     []echo.Port{},
		Subsets: []echo.SubsetConfig{{
			Version: "v1",
			// Set up custom annotations to mount the certs.
			Annotations: map[string]string{
				annotation.SidecarUserVolume.Name:      clientSidecarVolumes,

			ns := namespace.NewOrFail(t, t, namespace.Config{Prefix: "proxy-headers", Inject: true})
			cfg := echo.Config{
				Namespace: ns,
				Ports:     ports.All(),
				Service:   "no-headers",
				Subsets: []echo.SubsetConfig{
					{
						Annotations: map[string]string{annotation.ProxyConfig.Name: `
tracing: {}
proxyHeaders:
  forwardedClientCert: SANITIZE
  server:
    disabled: true
  requestId:

    for (int i = 1; i < numKeys; i++) {
      nodes.get(i).checkAcquiredLocks(Policies.THROW, nodes.subList(0, i));
    }
    // Pre-populate all disallowedPriorLocks with nodes of larger ordinal.
    for (int i = 0; i < numKeys - 1; i++) {
      nodes.get(i).checkAcquiredLocks(Policies.DISABLED, nodes.subList(i + 1, numKeys));
    }
    return Collections.unmodifiableMap(map);
  }

	// setup parameters
	MOVD	cnt+112(FP), R8
	XC	$12, (R1), (R1)     // reserved
	MVC	$4, 12(R8), 12(R1)  // set chain value
	MVC	$16, (R8), 64(R1)   // set initial counter value
	XC	$32, 16(R1), 16(R1) // set hash subkey and tag
	SLD	$3, R7, R12
	MOVD	R12, 48(R1)         // set total AAD length
	SLD	$3, R5, R12
	MOVD	R12, 56(R1)         // set total plaintext/ciphertext length

	LMG	key+8(FP), R8, R9   // R8=base R9=len