{
			name:        "destination rule with subsets",
			cluster:     &cluster.Cluster{Name: "foo", ClusterDiscoveryType: &cluster.Cluster_Type{Type: cluster.Cluster_EDS}},
			clusterMode: DefaultClusterMode,
			service:     service,
			port:        servicePort[0],
			proxyView:   model.ProxyViewAll,
			destRule: &networking.DestinationRule{
				Host: "foo.default.svc.cluster.local",
				Subsets: []*networking.Subset{
					{

	subk, _, err := registry.CreateKey(k, "subkey", registry.CREATE_SUB_KEY)
	if err != nil {
		t.Error(err)
		return
	}
	defer subk.Close()

	defer registry.DeleteKey(k, "subkey")

	ki, err := k.Stat()
	if err != nil {
		t.Error(err)
		return
	}
	if ki.SubKeyCount != 1 {
		t.Error("key must have 1 subkey")
	}
	if ki.MaxSubKeyLen != 6 {

	if listType != "sts-only" && listType != "svcacc-only" && listType != "" {
		// default to both
		listType = ""
	}

	var serviceAccounts []auth.Credentials
	var stsKeys []auth.Credentials

	if listType == "" || listType == "sts-only" {
		stsKeys, err = globalIAMSys.ListSTSAccounts(ctx, targetAccount)
		if err != nil {
			writeErrorResponseJSON(ctx, w, toAdminAPIErr(ctx, err), r.URL)
			return
		}
	}

// MultiVersion matches echos that have Multi-version specific setup.
var MultiVersion Matcher = func(i echo.Instance) bool {
	if len(i.Config().Subsets) != 2 {
		return false
	}
	var matchIstio, matchLegacy bool
	for _, s := range i.Config().Subsets {
		if s.Version == "vistio" {
			matchIstio = true
		} else if s.Version == "vlegacy" && s.Annotations[annotation.SidecarInject.Name] == "false" {

		}

		eps, err := a.CoreV1().Endpoints(ns).Get(context.TODO(), name, metav1.GetOptions{})
		if err != nil {
			return err
		}
		if len(eps.Subsets) == 0 {
			return fmt.Errorf("%s/%v endpoint not ready: no subsets", ns, name)
		}

		for _, subset := range eps.Subsets {
			if len(subset.Addresses) > 0 && len(subset.NotReadyAddresses) == 0 {
				service = s
				endpoints = eps
				return nil
			}
		}

					label{
						keyX: addString(strings, k),
						strX: addString(strings, v),
					},
				)
			}
		}
		var numKeys []string
		for k := range s.NumLabel {
			numKeys = append(numKeys, k)
		}
		sort.Strings(numKeys)
		for _, k := range numKeys {
			keyX := addString(strings, k)
			vs := s.NumLabel[k]
			units := s.NumUnit[k]
			for i, v := range vs {
				var unitX int64

        host: {{.Destination}}
        subset: my-subset
---
apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
  name: {{.Destination}}
spec:
  host: {{.Destination}}
  subsets:
  - name: my-subset
    labels:
      subset: my-subset`
			t.ConfigIstio().Eval(apps.Namespace.Name(), map[string]string{
				"Destination": "a",
			}, cfg).ApplyOrFail(t)
			from := apps.B[0]
			to := apps.A

				// Create a custom echo deployment in NS1 with subsets that allows us to test the
				// migration of a workload to istio (from no sidecar to sidecar).
				migrationApp = deployment.New(t).
					WithClusters(t.Clusters()...).WithConfig(echo.Config{
					Namespace:      echo1NS,
					Service:        migrationServiceName,
					ServiceAccount: true,
					Ports:          ports.All(),
					Subsets: []echo.SubsetConfig{
						{

		RequiresSingleCluster().
		Run(func(t framework.TestContext) {
			if t.Settings().Skip(echo.TProxy) {
				t.Skip()
			}
			workloads, err := apps.A[0].Workloads()
			if err != nil {
				t.Errorf("failed to get Subsets: %v", err)
				return
			}
			// check the server can see the client's original ip
			var srcIps []string
			for _, w := range workloads {
				srcIps = append(srcIps, w.Address())
			}

				Service:   fmt.Sprintf("client-%s", clName),
				Namespace: appNsInst,
				Cluster:   c,
				Ports:     nil,
				Subsets:   []echo.SubsetConfig{{}},
			}).
			WithConfig(echo.Config{
				Service:   "server",
				Namespace: appNsInst,
				Cluster:   c,
				Subsets:   []echo.SubsetConfig{{}},
				Ports: []echo.Port{
					{
						Name:         "http",
						Protocol:     protocol.HTTP,