},
	})
	_, _ = configStore.Create(config.Config{
		Meta: config.Meta{
			Name:             "rule1",
			Namespace:        "test1",
			GroupVersionKind: gvk.DestinationRule,
		},
		Spec: &networking.DestinationRule{
			ExportTo: []string{".", "ns1"},
		},
	})
	_, _ = configStore.Create(config.Config{
		Meta: config.Meta{
			Name:             "default",

				alt := GenerateAltVirtualHosts(a.Hostname.String(), 0, node.DNSDomain)
				sniHosts = append(sniHosts, a.Hostname.String())
				sniHosts = append(sniHosts, alt...)
			}
		}
		destinationRule := CastDestinationRule(node.SidecarScope.DestinationRule(
			model.TrafficDirectionOutbound, node, service.Hostname).GetRule())
		var destinationCIDRs []string
		if destinationCIDR != "" {
			destinationCIDRs = []string{destinationCIDR}
		}

        subset: "vistio"
  - name: "legacy-by-default"
    route:
    - destination:
        host: "multiversion"
        subset: "vlegacy"
---
apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
  name: "multiversion"
  annotations:
    test-suite: "automtls-partial-dr-mutual"
spec:
  host: "multiversion"
  subsets:
  - name: "vistio"
    labels:
      version: "vistio"

    route:
    - destination:
        host: a
  # Fallthrough
  - route:
    - destination:
        host: a
        subset: v1
---
apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
  name: a
spec:
  host: a
  subsets:
  - name: v1
    labels:
      version: v1
---
apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: integ-test

	if push == nil {
		return nil, nil
	}
	mergedDR := node.SidecarScope.DestinationRule(model.TrafficDirectionOutbound, node, svc.Hostname)
	destinationRule := mergedDR.GetRule()
	if destinationRule == nil {
		return nil, nil
	}
	rule := destinationRule.Spec.(*networking.DestinationRule)
	consistentHash := rule.GetTrafficPolicy().GetLoadBalancer().GetConsistentHash()

	ingressutil "istio.io/istio/tests/integration/security/sds_ingress/util"
)

// TestSimpleTlsOrigination test SIMPLE TLS mode with TLS origination happening at Gateway proxy
// It uses CredentialName set in DestinationRule API to fetch secrets from k8s API server
func TestSimpleTlsOrigination(t *testing.T) {
	// nolint: staticcheck
	framework.NewTest(t).
		RequiresSingleNetwork(). // https://github.com/istio/istio/issues/37134

						internalClient[0].CallOrFail(t, opts)
					})
			}
		})
}

const (
	// Destination Rule configs
	DestinationRuleConfigSimple = `
apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
  name: originate-tls-for-server-filebased-simple
spec:
  host: "external-service.{{.AppNamespace}}.svc.cluster.local"
  trafficPolicy:
    portLevelSettings:
      - port:

	// Path for Port in ServiceEntry.
	// Required parameters: port index.
	ServiceEntryPort = "{.spec.ports[%d].name}"

	// Path for DestinationRule tls certificate.
	// Required parameters: none.
	DestinationRuleTLSCert = "{.spec.trafficPolicy.tls.caCertificates}"

	// Path for DestinationRule port-level tls certificate.
	// Required parameters: portLevelSettings index.

				}
				assert.Equal(t, &got, c.want)
			}
		})
	}
}

func TestProtoSchemaConversions(t *testing.T) {
	destinationRuleSchema := collections.DestinationRule

	msg := &networking.DestinationRule{
		Host: "something.svc.local",
		TrafficPolicy: &networking.TrafficPolicy{
			LoadBalancer: &networking.LoadBalancerSettings{
				LbPolicy: &networking.LoadBalancerSettings_Simple{},
			},
		},

	env.SetPushContext(pushContext)
	pushContext.SetDestinationRulesForTesting([]config.Config{
		{
			Meta: config.Meta{
				GroupVersionKind: gvk.DestinationRule,
				Name:             "acme",
			},
			Spec: &networking.DestinationRule{
				Host: "test.example.org",
				TrafficPolicy: &networking.TrafficPolicy{
					OutlierDetection: &networking.OutlierDetection{},
				},
			},
		},
	})