ServiceAddressedWaypoint echo.Instances
	// Captured echo service
	Captured echo.Instances
	// Uncaptured echo Service
	Uncaptured echo.Instances
	// Sidecar echo services with sidecar
	Sidecar echo.Instances

	// All echo services
	All echo.Instances
	// Echo services that are in the mesh
	Mesh echo.Instances
	// Echo services that are not in mesh
	MeshExternal echo.Instances

        sidecar.istio.io/proxyCPU: 4000m
        sidecar.istio.io/status: '{"initContainers":["istio-init"],"containers":["istio-proxy"],"volumes":["workload-socket","credential-socket","workload-certs","istio-envoy","istio-data","istio-podinfo","istio-token","istiod-ca-cert"],"imagePullSecrets":null,"revision":"default"}'
        traffic.sidecar.istio.io/excludeInboundPorts: 4,5,6

// either the service or sidecar resource.
func TestPeerAuthenticationWithSidecar(t *testing.T) {
	pa := `
apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
  name: default
spec:
  selector:
    matchLabels:
      app: foo
  mtls:
    mode: STRICT
  portLevelMtls:
    9090:
      mode: DISABLE
---`
	sidecar := `
apiVersion: networking.istio.io/v1alpha3

          # This is a horrible idea for production images, but these are just for tests.
          [[ -f /tmp/istio-sidecar.rpm ]] && sudo rpm -vi /tmp/istio-sidecar.rpm && sudo rm /tmp/istio-sidecar.rpm
          [[ -f /tmp/istio-sidecar.deb ]] && sudo dpkg -i /tmp/istio-sidecar.deb && sudo rm /tmp/istio-sidecar.deb

          # Read root cert from and place signed certs here (can't mount directly or the dir would be unwritable)

        prometheus.io/scrape: "true"
        sidecar.istio.io/interceptionMode: REDIRECT
        sidecar.istio.io/status: '{"initContainers":["istio-validation"],"containers":["istio-proxy"],"volumes":["workload-socket","credential-socket","workload-certs","istio-envoy","istio-data","istio-podinfo","istio-token","istiod-ca-cert"],"imagePullSecrets":null,"revision":"default"}'
        traffic.sidecar.istio.io/excludeInboundPorts: "15020"

,"serviceCluster":"istio-proxy","statusPort":15020},"sidecar.istio.io/extraStatTags":"dlp_status,dlp_error","sidecar.istio.io/statsHistogramBuckets":"{\"istio\":[1,5,10,50,100,500,1000,5000,10000],\"envoy\":[1,5,10,25,50,100,250,500,1000,2500,5000,10000]}","sidecar.istio.io/statsInclusionPrefixes":"prefix1,prefix2,http.{pod_ip}_","sidecar.istio.io/statsInclusionRegexps":"http.[0-9]*\\.[0-9]*\\.[0-9]*\\.[0-9]*_8080.downstream_rq_time","sidecar.istio.io/statsInclusionSuffixes":"suffix1,suffix2,ups...

        prometheus.io/path: /stats/prometheus
        prometheus.io/port: "15020"
        prometheus.io/scrape: "true"
        sidecar.istio.io/proxyCPU: 100m
        sidecar.istio.io/proxyCPULimit: 1000m
        sidecar.istio.io/proxyMemory: 1Gi
        sidecar.istio.io/proxyMemoryLimit: 2Gi

        prometheus.io/scrape: "true"
        sidecar.istio.io/status: '{"initContainers":["istio-init"],"containers":["istio-proxy"],"volumes":["workload-socket","credential-socket","workload-certs","istio-envoy","istio-data","istio-podinfo","istio-token","istiod-ca-cert"],"imagePullSecrets":null,"revision":"default"}'
        traffic.sidecar.istio.io/excludeInboundPorts: 4,5,6
        traffic.sidecar.istio.io/excludeOutboundIPRanges: 10.96.0.2/24,10.96.0.3/24

        prometheus.io/scrape: "true"
        sidecar.istio.io/interceptionMode: REDIRECT
        sidecar.istio.io/status: '{"initContainers":["istio-validation"],"containers":["istio-proxy"],"volumes":["workload-socket","credential-socket","workload-certs","istio-envoy","istio-data","istio-podinfo","istio-token","istiod-ca-cert"],"imagePullSecrets":null,"revision":"default"}'
        traffic.sidecar.istio.io/excludeInboundPorts: "15020"

	case Secret:
		return "Secret"
	case Service:
		return "Service"
	case ServiceAccount:
		return "ServiceAccount"
	case ServiceEntry:
		return "ServiceEntry"
	case Sidecar:
		return "Sidecar"
	case StatefulSet:
		return "StatefulSet"
	case TCPRoute:
		return "TCPRoute"
	case TLSRoute:
		return "TLSRoute"
	case Telemetry:
		return "Telemetry"
	case UDPRoute: