//   - 1 gateway for network1
//   - 3 gateway for network2
//   - 1 gateway for network3
//   - 0 gateways for network4
func environment(t test.Failer, c ...config.Config) *xds.FakeDiscoveryServer {
	ds := xds.NewFakeDiscoveryServer(t, xds.FakeOptions{
		Configs: c,
		Services: []*model.Service{{
			Hostname:   "example.ns.svc.cluster.local",
			Attributes: model.ServiceAttributes{Name: "example", Namespace: "ns"},

// See the License for the specific language governing permissions and
// limitations under the License.

package xds

import (
	discovery "github.com/envoyproxy/go-control-plane/envoy/service/discovery/v3"

	"istio.io/istio/pilot/pkg/model"
	"istio.io/istio/pilot/pkg/util/protoconv"
	v3 "istio.io/istio/pilot/pkg/xds/v3"
	"istio.io/istio/pkg/config/schema/kind"
	"istio.io/istio/pkg/util/sets"
)

type WorkloadGenerator struct {

func PushXds[T any](xds model.XDSUpdater, f func(T) model.ConfigKey) func(events []krt.Event[T], initialSync bool) {
	return func(events []krt.Event[T], initialSync bool) {
		cu := sets.New[model.ConfigKey]()
		for _, e := range events {
			for _, i := range e.Items() {
				cu.Insert(f(i))
			}
		}
		xds.ConfigUpdate(&model.PushRequest{
			Full:           false,

metadata:
  name: concrete
  namespace: default
spec:
  clusterIP: 1.2.3.4
  ports:` + ports
	runSimulationTest(t, nil, xds.FakeOptions{}, simulationTest{
		kubeConfig: service,
		calls:      calls,
	})

	// HTTP Routes
	runSimulationTest(t, nil, xds.FakeOptions{}, simulationTest{
		config: `apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: alias
spec:

// WatchedResources may use same or different Generator.
// Note: any errors returned will completely close the XDS stream. Use with caution; typically and empty
// or no response is preferred.
type XdsResourceGenerator interface {
	// Generate generates the Sotw resources for Xds.
	Generate(proxy *Proxy, w *WatchedResource, req *PushRequest) (Resources, XdsLogDetails, error)
}

	}
	o := &istioagent.AgentOptions{
		XDSRootCerts:             xdsRootCA,
		CARootCerts:              caRootCA,
		XDSHeaders:               map[string]string{},
		XdsUdsPath:               filepath.Join(cfg.ConfigPath, "XDS"),
		IsIPv6:                   proxy.IsIPv6(),
		ProxyType:                proxy.Type,
		EnableDynamicProxyConfig: enableProxyConfigXdsEnv,
		WASMOptions: wasm.Options{
			InsecureRegistries:    sets.New(insecureRegistries...),

	"google.golang.org/grpc/credentials"

	"istio.io/istio/pkg/security"
)

// TokenProvider is a grpc PerRPCCredentials that can be used to attach a JWT token to each gRPC call.
// TokenProvider can be used for XDS, which may involve token exchange through STS.
type DefaultTokenProvider struct {
	opts *security.Options
}

var _ credentials.PerRPCCredentials = &DefaultTokenProvider{}

	"regexp"
	"strings"
	"time"

	"google.golang.org/protobuf/proto"

	networking "istio.io/api/networking/v1alpha3"
	"istio.io/istio/pkg/config"
	"istio.io/istio/pkg/config/labels"
	"istio.io/istio/pkg/config/xds"
	"istio.io/istio/pkg/util/sets"
)

// EnvoyFilterWrapper is a wrapper for the EnvoyFilter api object with pre-processed data
type EnvoyFilterWrapper struct {
	Name             string
	Namespace        string

	"istio.io/istio/pilot/pkg/model"
	"istio.io/istio/pilot/pkg/networking/util"
	sec_model "istio.io/istio/pilot/pkg/security/model"
	"istio.io/istio/pilot/pkg/util/protoconv"
	"istio.io/istio/pilot/pkg/xds/endpoints"
	v3 "istio.io/istio/pilot/pkg/xds/v3"
	"istio.io/istio/pkg/config/host"
	"istio.io/istio/pkg/config/protocol"
	"istio.io/istio/pkg/log"
	"istio.io/istio/pkg/spiffe"
)

	).Get()

	// EnableUnsafeDeltaTest enables runtime checks to test Delta XDS efficiency. This should never be enabled in
	// production.
	EnableUnsafeDeltaTest = env.Register(
		"UNSAFE_PILOT_ENABLE_DELTA_TEST",
		false,
		"If enabled, addition runtime tests for Delta XDS efficiency are added. "+
			"These checks are extremely expensive, so this should be used only for testing, not production.",