var out []string
	errs := istiomultierror.New()

	var mu sync.Mutex
	var wg sync.WaitGroup
	doResolve := func(dnsType uint16) {
		defer wg.Done()

		res := n.client.Query(new(dns.Msg).SetQuestion(dns.Fqdn(name), dnsType))

		mu.Lock()
		defer mu.Unlock()
		if res.Rcode == dns.RcodeServerFailure {
			errs = multierror.Append(errs, fmt.Errorf("upstream dns failure, qtype: %v", dnsType))
			return
		}

	var endpoints []*model.IstioEndpoint
	if slice.AddressType == v1.AddressTypeFQDN {
		// TODO(https://github.com/istio/istio/issues/34995) support FQDN endpointslice
		return
	}
	svc := esc.c.GetService(hostName)
	discoverabilityPolicy := esc.c.exports.EndpointDiscoverabilityPolicy(svc)

	for _, e := range slice.Endpoints {

}

func TestWarningsOnEndpointSliceAddressType(t *testing.T) {
	tests := []struct {
		name        string
		addressType discovery.AddressType
		wantWarning bool
	}{
		{
			name:        "AddressType = FQDN",
			addressType: discovery.AddressTypeFQDN,
			wantWarning: true,
		},
		{
			name:        "AddressType = IPV4",
			addressType: discovery.AddressTypeIPv4,
			wantWarning: false,
		},
		{

// mDNS, and may use platform-dependent DNS stub resolver if possible.
// The APIs accept any of forms for a query; host name in various
// encodings, UTF-8 encoded net name, domain name, FQDN or absolute
// FQDN, but the result would be one of the forms and it depends on
// the circumstances.

var lookupGoogleSRVTests = []struct {
	service, proto, name string
	cname, target        string
}{
	{

// Service describes an Istio service (e.g., catalog.mystore.com:8080)
// Each service has a fully qualified domain name (FQDN) and one or more
// ports where the service is listening for connections. *Optionally*, a
// service can have a single load balancer/virtual IP address associated
// with it, such that the DNS queries for the FQDN resolves to the virtual
// IP address (a load balancer IP).
//
// E.g., in kubernetes, a service foo is associated with

# with configurations that support non-traditional KSA authentication methods,
# this value may make sense, but if the expectation is traditional OIDC, don't
# use this value in production. If you do use it, the FQDN is preferred to
# kubernetes.default.svc, to avoid something outside the cluster attempting
# to resolve the partially qualified name.
export SERVICEACCOUNT_ISSUER='https://kubernetes.default.svc.cluster.local'

func buildServiceMetadata(svc *model.Service) *structpb.Value {
	return &structpb.Value{
		Kind: &structpb.Value_StructValue{
			StructValue: &structpb.Struct{
				Fields: map[string]*structpb.Value{
					// service fqdn
					"host": {
						Kind: &structpb.Value_StringValue{
							StringValue: string(svc.Hostname),
						},
					},
					// short name of the service
					"name": {
						Kind: &structpb.Value_StringValue{

	} else {
		// Explicitly set 127.0.0.1 so Console will automatically bypass TLS verification to the local S3 API.
		// This will save users from providing a certificate with IP or FQDN SAN that points to the local host.
		os.Setenv("CONSOLE_MINIO_SERVER", fmt.Sprintf("%s://127.0.0.1:%s", getURLScheme(globalIsTLS), globalMinioPort))
	}
	if value := env.Get(config.EnvMinIOLogQueryURL, ""); value != "" {

	// If this service entry had endpoints with IPs (i.e. resolution STATIC), then we do EDS update.
	// If the service entry had endpoints with FQDNs (i.e. resolution DNS), then we need to do
	// full push (as fqdn endpoints go via strict_dns clusters in cds).
	if len(unchangedSvcs) > 0 {
		if isDNSTypeServiceEntry(currentServiceEntry) {
			for _, svc := range unchangedSvcs {
				configsUpdated.Insert(makeConfigKey(svc))
			}

	// Standard PROXY source and destination information
	// is included, along with potential extra TLV headers:
	// 0xD0 - The SPIFFE identity of the source workload
	// 0xD1 - The FQDN or Hostname of the targeted Service
	ApplicationTunnel_PROXY ApplicationTunnel_Protocol = 1
)

// Enum value maps for ApplicationTunnel_Protocol.
var (
	ApplicationTunnel_Protocol_name = map[int32]string{