},
			},
			result: []*workloadapi.Service{
				{
					Name:      "name",
					Namespace: "ns",
					Hostname:  "a.example.com",
					Addresses: []*workloadapi.NetworkAddress{{
						Network: testNW,
						Address: netip.AddrFrom4([4]byte{1, 2, 3, 4}).AsSlice(),
					}},
					Ports: []*workloadapi.Port{{
						ServicePort: 80,
						TargetPort:  80,
					}},
					SubjectAltNames: []string{"san1"},

        },
        "filter_chains": [
          {
            "filters": [
              {
                "name": "envoy.filters.network.http_connection_manager",
                "typed_config": {
                  "@type": "type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager",
                  "codec_type": "AUTO",
                  "stat_prefix": "stats",

			sortServiceInstances(tt.out)

			if tt.wle.Locality != "" || tt.clusterID != "" || tt.wle.Network != "" {
				for _, serviceInstance := range tt.out {
					serviceInstance.Endpoint.Locality = model.Locality{
						Label:     tt.wle.Locality,
						ClusterID: tt.clusterID,
					}
					serviceInstance.Endpoint.Network = network.ID(tt.wle.Network)

{
  "cniVersion": "0.3.1",
  "name": "k8s-pod-network",
  "plugins": [
    {
      "bridge": "cni0",
      "dns": {
        "nameservers": [
          "10.1.0.1"
        ]
      },
      "ipam": {
        "gateway": "10.1.0.1",
        "subnet": "10.1.0.0/16",
        "type": "host-local"
      },
      "name": "dbnet",
      "type": "bridge"
    },
    {
      "ambient_enabled": false,
      "cni_event_address": "",

# CuDNN: https://docs.nvidia.com/deeplearning/sdk/cudnn-install/index.html#ubuntu-network-installation
libcudnn9-dev-cuda-12=9.1.1.17-1
libcudnn9-cuda-12=9.1.1.17-1

# This can be removed once NVIDIA publishes a cuda-12.3.2 Docker image.
# For now it ensures that we install at least version 12.3.107 of PTXAS,
# since 12.3.103 has a bug.

									StringValue: ";;;;",
								},
							},
						},
					},
				},
			},
		},
		{
			name: "network and tls mode",
			metadata: &model.EndpointMetadata{
				TLSMode:      model.IstioMutualTLSModeLabel,
				Network:      "network",
				WorkloadName: "",
				ClusterID:    "",
			},
			want: &core.Metadata{
				FilterMetadata: map[string]*structpb.Struct{

        {{- end}}
        "filter_chains": [
          {
            "filters": [
              {
                "name": "envoy.filters.network.http_connection_manager",
                "typed_config": {
                  "@type": "type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager",
                  "codec_type": "AUTO",
                  "stat_prefix": "stats",

{
  "cniVersion": "0.3.1",
  "name": "k8s-pod-network",
  "plugins": [
    {
      "addIf": "true",
      "bridge": "mybridge",
      "ipMasq": true,
      "ipam": {
        "gateway": "10.1.0.1",
        "routes": [
          {
            "dst": "0.0.0.0/0"
          }
        ],
        "subnet": "10.1.0.0/16",
        "type": "host-local"
      },
      "isGateway": true,
      "mtu": 1460,

		return nil, nil, err
	}

	cluster, network := extractClusterAndNetwork(params)

	// use network in values for template, and proxy env variables
	if cluster != "" {
		params.proxyEnvs["ISTIO_META_CLUSTER_ID"] = cluster
	}
	if network != "" {
		params.proxyEnvs["ISTIO_META_NETWORK"] = network
	}

	strippedPod, err := reinsertOverrides(stripPod(params))
	if err != nil {

{
  "name": "k8s-pod-network",
  "plugins": [
    {
      "type": "calico",
      "etcd_endpoints": "http://10.110.0.136:6666",
      "plugin_log_level": "info",
      "mtu": 1500,
      "ipam": {
        "type": "calico-ipam"
      },
      "policy": {
        "type": "k8s"
      },
      "kubernetes": {
        "kubeconfig": "/etc/cni/net.d/calico-kubeconfig"
      }
    },
    {
      "type": "portmap",