package inject

import (
	"fmt"
	"net/netip"
	"strconv"
	"strings"

	"github.com/hashicorp/go-multierror"

	"istio.io/api/annotation"
	meshconfig "istio.io/api/mesh/v1alpha1"
	"istio.io/istio/pilot/pkg/model"
	"istio.io/istio/pkg/config/mesh"
	"istio.io/istio/pkg/config/validation/agent"
	"istio.io/istio/pkg/util/protomarshal"
)

type annotationValidationFunc func(value string) error

				{
					Type:    corev1.NodeExternalIP,
					Address: nodeIP,
				},
			},
		},
	},
}

func fakeMeshHolder(ingressService string) mesh.Watcher {
	config := mesh.DefaultMeshConfig()
	config.IngressService = ingressService
	return mesh.NewFixedWatcher(config)
}

func makeStatusSyncer(t *testing.T, name string) *StatusSyncer {
	client := kubelib.NewFakeClient(testObjects...)

    #
    # If an administrator expects that any of these conditions may become true in
    # the future, they should ensure their meshes have different Mesh IDs
    # assigned.
    #
    # Within a multicluster mesh, each cluster must be (manually or auto)
    # configured to have the same Mesh ID value. If an existing cluster 'joins' a

type RemoteKubeClientGetter func(clusterID cluster.ID) kubernetes.Interface

// KubeJWTAuthenticator authenticates K8s JWTs.
type KubeJWTAuthenticator struct {
	// holder of a mesh configuration for dynamically updating trust domain
	meshHolder mesh.Holder

	// Primary cluster kube client
	kubeClient kubernetes.Interface
	// Primary cluster ID
	clusterID cluster.ID

	// remote cluster kubeClient getter

kind: Gateway
metadata:
  annotations:
    gateway.istio.io/controller-version: "5"
---
apiVersion: v1
kind: ServiceAccount
metadata:
  annotations: {}
  labels:
    gateway.istio.io/managed: istio.io-mesh-controller
    gateway.networking.k8s.io/gateway-name: namespace
    istio.io/gateway-name: namespace
    topology.istio.io/network: network-1
  name: namespace
  namespace: default
  ownerReferences:

kind: Gateway
metadata:
  annotations:
    gateway.istio.io/controller-version: "5"
---
apiVersion: v1
kind: ServiceAccount
metadata:
  annotations: {}
  labels:
    gateway.istio.io/managed: istio.io-mesh-controller
    gateway.networking.k8s.io/gateway-name: namespace
    istio.io/gateway-name: namespace
    topology.istio.io/network: network-1
  name: namespace
  namespace: default
  ownerReferences:

# Authentication policy to enable mutual TLS for all services (that have sidecar) in the mesh.
apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
  name: default
  namespace: istio-config
spec:
  mtls:
    mode: STRICT
---
# Corresponding destination rule to configure client side to use mutual TLS when talking to
# any service (host) in the mesh.
apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:

	wrappers "google.golang.org/protobuf/types/known/wrapperspb"

	meshconfig "istio.io/api/mesh/v1alpha1"
	networking "istio.io/api/networking/v1alpha3"
	"istio.io/istio/pilot/pkg/config/memory"
	"istio.io/istio/pilot/pkg/model"
	memregistry "istio.io/istio/pilot/pkg/serviceregistry/memory"
	"istio.io/istio/pkg/config"
	"istio.io/istio/pkg/config/mesh"
	"istio.io/istio/pkg/config/protocol"
	"istio.io/istio/pkg/config/schema/collections"

apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: mesh-route-outbound-traffic-to-external-svc-via-egress-gw
spec:
  hosts:
  - external.{{ .externalNamespace }}.svc.cluster.local
  gateways:
  - mesh
  tcp:
  - match:
    - port: {{ .externalSvcTcpPort }}
    route:
    - destination:

apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: mesh-route-outbound-traffic-to-external-svc-via-egress-gw
spec:
  hosts:
  - external.{{ .externalNamespace }}.svc.cluster.local
  gateways:
  - mesh
  tcp:
  - match:
    - port: {{ .externalSvcTcpPort }}
    route:
    - destination: