{
					Ne: &meshconfig.Network_NetworkEndpoints_FromCidr{
						FromCidr: "192.168.0.1/24",
					},
				},
			},
			Gateways: []*meshconfig.Network_IstioNetworkGateway{
				{
					Gw: &meshconfig.Network_IstioNetworkGateway_Address{
						Address: "1.1.1.1",
					},
					Port: 80,
				},
			},
		},
		"network2": {
			Endpoints: []*meshconfig.Network_NetworkEndpoints{
				{

		for _, cfg := range impactedConfigs {
			gw := config.Config{
				Meta: config.Meta{
					GroupVersionKind: gvk.KubernetesGateway,
					Namespace:        cfg.Namespace,
					Name:             cfg.Name,
				},
			}
			c.secretHandler(gw, gw, model.EventUpdate)
		}
	}
}

	return runtime.Identifier("fake")
}

func gzipContent(data []byte, level int) []byte {
	buf := &bytes.Buffer{}
	gw, err := gzip.NewWriterLevel(buf, level)
	if err != nil {
		panic(err)
	}
	if _, err := gw.Write(data); err != nil {
		panic(err)
	}
	if err := gw.Close(); err != nil {
		panic(err)
	}
	return buf.Bytes()

	service *corev1.Service
	pods    []*corev1.Pod
}

func (ingress *ingressInfo) match(gw *clientnetworking.Gateway) bool {
	if ingress == nil || gw == nil {
		return false
	}
	if gw.Spec.Selector == nil {
		return true
	}
	for _, p := range ingress.pods {
		if maps.Contains(p.GetLabels(), gw.Spec.Selector) {
			return true
		}
	}
	return false
}

				},
			},
		},
		simulationTest{
			name: "multiple virtual services that should become separate vhosts",
			config: `
apiVersion: networking.istio.io/v1beta1
kind: Gateway
metadata:
  name: public-gw
  namespace: istio-system
spec:
  selector:
    istio: ingressgateway
  servers:
    - port:
        number: 80
        name: http
        protocol: HTTP
      hosts:
        - foo.example.com

								Ne: &meshconfig.Network_NetworkEndpoints_FromRegistry{
									FromRegistry: "Kubernetes",
								},
							},
						},
						Gateways: []*meshconfig.Network_IstioNetworkGateway{
							{
								Gw: &meshconfig.Network_IstioNetworkGateway_RegistryServiceName{
									RegistryServiceName: "istio-ingressgateway.istio-system.svc.cluster.local",
								},
								Port: 80,
							},
						},
					},

	if len(root.Gateways) > 0 && len(leaf.Gateways) > 0 {
		if len(root.Gateways) < len(leaf.Gateways) {
			return true
		}
		rootGateway := sets.New(root.Gateways...)
		for _, gw := range leaf.Gateways {
			if !rootGateway.Contains(gw) {
				return true
			}
		}
	}

	return false
}

func stringMatchConflict(root, leaf *networking.StringMatch) bool {
	// no conflict when root or leaf is not specified

	}
	return b, nil
}

// CreateCustomEgressSecret creates a k8s secret "cacerts" to store egress gateways CA key and cert.
func CreateCustomEgressSecret(ctx resource.Context) error {
	name := "egress-gw-cacerts"
	systemNs, err := istio.ClaimSystemNamespace(ctx)
	if err != nil {
		return err
	}

	var caKey, certChain, rootCert, fakeRootCert []byte
	if caKey, err = ReadCustomCertFromFile("key.pem"); err != nil {

000002d0  c7 51 5e a0 fb 55 5a 01  34 cc d1 a6 22 df d6 00  |.Q^..UZ.4..."...|
000002e0  f5 73 e0 9e b8 9d 2a a9  49 3a 99 ba 17 00 80 14  |.s....*.I:......|
000002f0  95 47 77 a1 48 b4 e7 ba  6a e8 0e 4e ee 55 25 f5  |.Gw.H...j..N.U%.|
00000300  ea 82 65 b4 3f db a2 94  03 cc d3 6c 4a e6 cf 57  |..e.?......lJ..W|
00000310  25 4c 79 b8 fb ab dd 1f  68 e4 55 87 b1 46 12 30  |%Ly.....h.U..F.0|

00000160  e3 74 f9 b3 52 bf 0e 0b  e1 31 7c 2c cb fd f2 8c  |.t..R....1|,....|
00000170  bf 27 40 6d 26 b7 62 47  56 91 22 00 67 9a df 4f  |.'@m&.bGV.".g..O|
00000180  f0 47 57 3c a6 46 4d 16  f6 8d fc 2d 91 c4 1a bf  |.GW<.FM....-....|
00000190  38 63 ec 63 fe 97 14 80  aa 5b 60 ff c8 77 57 9c  |8c.c.....[`..wW.|
000001a0  d5 86 a6 76 96 b3 e9 db  c9 eb dd 94 84 2a 46 f5  |...v.........*F.|