type IngressTLS struct {
	// hosts is a list of hosts included in the TLS certificate. The values in
	// this list must match the name/s used in the tlsSecret. Defaults to the
	// wildcard host setting for the loadbalancer controller fulfilling this
	// Ingress, if left unspecified.
	// +optional
	// +listType=atomic
	Hosts []string `json:"hosts,omitempty" protobuf:"bytes,1,rep,name=hosts"`

	framework.
		NewTest(t).
		Run(func(t framework.TestContext) {
			cfg := `apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: {{.Destination}}
spec:
  hosts:
  - {{.Destination}}
  http:
  - route:
    - destination:
        host: {{.Destination}}
        subset: my-subset
---
apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:

import javax.net.ssl.X509ExtendedTrustManager
import okhttp3.internal.peerName
import org.codehaus.mojo.animal_sniffer.IgnoreJRERequirement

/**
 * This extends [X509ExtendedTrustManager] to disable verification for a set of hosts.
 *
 * Note that the superclass [X509ExtendedTrustManager] isn't available on Android until version 7
 * (API level 24).
 */
@IgnoreJRERequirement
internal class InsecureExtendedTrustManager(

		},
	}
}

// SortVirtualHosts sorts a slice of virtual hosts by name.
//
// Envoy computes a hash of RDS to see if things have changed - hash is affected by order of elements in the filter. Therefore
// we sort virtual hosts by name before handing them back so the ordering is stable across HTTP Route Configs.
func SortVirtualHosts(hosts []*route.VirtualHost) {
	if len(hosts) < 2 {
		return
	}

	cfg.Eval(ns.Name(), map[string]any{
		"Namespaces": namespaces,
	}, `
apiVersion: networking.istio.io/v1alpha3
kind: Sidecar
metadata:
  name: restrict-to-namespace
spec:
  egress:
  - hosts:
    - "istio-system/*"
{{ range $ns := .Namespaces }}
    - "{{ $ns.Name }}/*"
{{ end }}
`)

	if !t.Settings().DisableDefaultExternalServiceConnectivity {

		}
	}
	return foundSet.ToSlice()
}

// hostsSorted will return all hosts found.
// The LOCAL host will be nil, but the indexes of all hosts should
// remain consistent across the cluster.
func (l EndpointServerPools) hostsSorted() []*xnet.Host {
	peers, localPeer := l.peers()
	sort.Strings(peers)
	hosts := make([]*xnet.Host, len(peers))
	for i, hostStr := range peers {
		if hostStr == localPeer {

)

type ApplyFunc = func(tcpProxy *tcp.TcpProxy, destinationRule *networking.DestinationRule, subsetName string)

// Apply configures tunneling_config in a given TcpProxy depending on the destination rule and the destination hosts
var Apply ApplyFunc = func(tcpProxy *tcp.TcpProxy, destinationRule *networking.DestinationRule, subsetName string) {
	var tunnelSettings *networking.TrafficPolicy_TunnelSettings
	if subsetName != "" {

	}
	validateRouteConfigurationDomains(t, l)
}

func validateRouteConfigurationDomains(t testing.TB, l *route.RouteConfiguration) {
	t.Helper()

	vhosts := sets.New[string]()
	domains := sets.New[string]()
	for _, vhost := range l.VirtualHosts {
		if vhosts.InsertContains(vhost.Name) {
			t.Errorf("duplicate virtual host found %s", vhost.Name)
		}
		for _, domain := range vhost.Domains {

	}

	// TODO this is only checking one controller - we may be missing service vips for instances in another cluster
	res := make([]*workloadapi.Service, 0, len(svc.Spec.Hosts))
	for _, h := range svc.Spec.Hosts {
		res = append(res, &workloadapi.Service{
			Name:            svc.Name,
			Namespace:       svc.Namespace,
			Hostname:        h,
			Addresses:       addresses,
			Ports:           ports,

import java.security.cert.CertificateException
import java.security.cert.X509Certificate
import javax.net.ssl.X509TrustManager

/** This extends [X509TrustManager] for Android to disable verification for a set of hosts. */
internal class InsecureAndroidTrustManager(
  private val delegate: X509TrustManager,
  private val insecureHosts: List<String>,
) : X509TrustManager {
  private val checkServerTrustedMethod: Method? =
    try {