func tlsModeForDestinationRule(drc *config.Config, subset string, port int) *networkingapi.ClientTLSSettings_TLSmode {
	if drc == nil {
		return nil
	}
	dr, ok := drc.Spec.(*networkingapi.DestinationRule)
	if !ok || dr == nil {
		return nil
	}

	if subset == "" {
		return trafficPolicyTLSModeForPort(dr.GetTrafficPolicy(), port)
	}

	for _, ss := range dr.Subsets {
		if ss.Name != subset {
			continue
		}

}

// getDestRuleSubsets gets names of subsets that match any pod labels (also, ones that don't match).
func getDestRuleSubsets(subsets []*v1alpha3.Subset, podsLabels []klabels.Set) ([]string, []string) {
	matchingSubsets := make([]string, 0, len(subsets))
	nonmatchingSubsets := make([]string, 0, len(subsets))
	for _, subset := range subsets {
		subsetSelector := klabels.SelectorFromSet(subset.Labels)

					}
					for _, subset := range tt.destRule.Subsets {
						if subset.Name == subsetName {
							if subset.GetTrafficPolicy().GetTls() != nil {
								verifyALPNOverride(t, c.Metadata, subset.TrafficPolicy.Tls.Mode)
							}
						}
					}
				}
			}

			// Validate that ORIGINAL_DST cluster does not have load assignments
			for _, subset := range subsetClusters {

			args: strings.Split("service productpage", " "),
			expectedOutput: `Service: productpage
DestinationRule: productpage for "productpage"
   WARNING POD DOES NOT MATCH ANY SUBSETS.  (Non matching subsets v1)
   Matching subsets: 
      (Non-matching subsets v1)
   No Traffic Policy
VirtualService: bookinfo
   Route to host "productpage" with weight 30%
   Route to host "productpage2" with weight 20%

	}{
		{
			name: "tunneling_config should not be applied when destination rule and listener subsets do not match",
			routeDestinations: []*networking.RouteDestination{
				{
					Destination: &networking.Destination{
						Host:   "tunnel-proxy.com",
						Port:   &networking.PortSelector{Number: 3128},
						Subset: "random-subset",
					},
				},
			},
			destinationRule:         tunnelingEnabledForSubset,

func (h Names) Intersection(other Names) Names {
	result := make(Names, 0, len(h))
	for _, hHost := range h {
		for _, oHost := range other {
			if hHost.SubsetOf(oHost) {
				if !result.Contains(hHost) {
					result = append(result, hHost)
				}
			} else if oHost.SubsetOf(hHost) {
				if !result.Contains(oHost) {
					result = append(result, oHost)
				}
			}
		}
	}
	return result
}

// - VM
// - Naked
// - Headless
// - TProxy
// - Multi-Subset
var RegularPod Matcher = func(instance echo.Instance) bool {
	return instance.Config().IsRegularPod()
}

var NotRegularPod = Not(RegularPod)

// MultiVersion matches echos that have Multi-version specific setup.
var MultiVersion Matcher = func(i echo.Instance) bool {
	if len(i.Config().Subsets) != 2 {
		return false
	}
	var matchIstio, matchLegacy bool

	}

	// both are non-wildcards, so do normal string comparison
	return n == o
}

// SubsetOf returns true if this hostname is a valid subset of the other hostname. The semantics are
// the same as "Matches", but only in one direction (i.e., n is covered by o).
func (n Name) SubsetOf(o Name) bool {
	hWildcard := n.IsWildCarded()
	oWildcard := o.IsWildCarded()

	if hWildcard {
		if oWildcard {

	// empty subset
	if subsetName == "" {
		return nil
	}

	if dr == nil {
		return nil
	}

	for _, subset := range dr.Subsets {
		if subset.Name == subsetName {
			if len(subset.Labels) == 0 {
				return nil
			}
			return subset.Labels
		}
	}

	return nil

			},
		},
		Subsets: []*networking.Subset{
			{
				Name: "foo",
				Labels: map[string]string{
					"test": "label",
				},
			},
		},
	}

	wantJSON := `
		{
      "host":"something.svc.local",
      "trafficPolicy": {
        "loadBalancer":{"simple":"UNSPECIFIED"}
       },
       "subsets": [
         {"name":"foo","labels":{"test":"label"}}
       ]