}

func maybeSetHashPolicy(destinationRule *networking.DestinationRule, tcpProxy *tcp.TcpProxy, subsetName string) {
	if destinationRule != nil {
		useSourceIP := destinationRule.GetTrafficPolicy().GetLoadBalancer().GetConsistentHash().GetUseSourceIp()
		for _, subset := range destinationRule.Subsets {
			if subset.Name != subsetName {
				continue
			}

			dr: &config.Config{
				Spec: &networking.DestinationRule{
					TrafficPolicy: &networking.TrafficPolicy{
						OutlierDetection: &networking.OutlierDetection{
							ConsecutiveErrors: 5,
						},
					},
				},
			},
			expectedLabels: nil,
		},
		{
			name: "failover priority disabled",
			dr: &config.Config{
				Spec: &networking.DestinationRule{
					TrafficPolicy: &networking.TrafficPolicy{

			b.failoverPriorityLabels = util.GetFailoverPriorityLabels(b.proxy.Labels, lbSetting.FailoverPriority)
		}
	}
}

func (b *EndpointBuilder) DestinationRule() *v1alpha3.DestinationRule {
	if dr := b.destinationRule.GetRule(); dr != nil {
		dr, _ := dr.Spec.(*v1alpha3.DestinationRule)
		return dr
	}
	return nil
}

func (b *EndpointBuilder) Type() string {
	return model.EDSType
}

					},
				},
			},
		},
	}

	destinationRule := config.Config{
		Meta: config.Meta{
			GroupVersionKind: gvk.DestinationRule,
			Name:             "acme-v3-1",
			Namespace:        "not-default",
		},
		Spec: destinationRuleSpec,
	}

	subsetdestinationRuleSpec := &networking.DestinationRule{
		Host: "subsettest.com",
		TrafficPolicy: &networking.TrafficPolicy{

  This means server certificates will be automatically verified using the OS CA certificates when not using a DestinationRule caCertificates field.
  If undesired please use the new `compatibilityVersion` feature to fallback to old behavior, or `insecureSkipVerify`
  field in DestinationRule to skip the verification.
upgradeNotes:
- title: Default value of the feature flag `VERIFY_CERT_AT_CLIENT` is set to true
  content: |

)

type ApplyFunc = func(tcpProxy *tcp.TcpProxy, destinationRule *networking.DestinationRule, subsetName string)

// Apply configures tunneling_config in a given TcpProxy depending on the destination rule and the destination hosts
var Apply ApplyFunc = func(tcpProxy *tcp.TcpProxy, destinationRule *networking.DestinationRule, subsetName string) {
	var tunnelSettings *networking.TrafficPolicy_TunnelSettings

						name            string
						destinationRule string
						expectSuccess   bool
					}{
						{
							name:            "connection fails when DR doesn't match SA",
							destinationRule: defaultIdentityDR,
							expectSuccess:   false,
						},
						{
							name:            "connection succeeds when DR matches SA",
							destinationRule: correctIdentityDR,
							expectSuccess:   true,

			"testdata/destinationrule-mutual-destination.yaml",
		},
		analyzer: &destinationrule.CaCertificateAnalyzer{},
		expected: []message{
			{msg.NoServerCertificateVerificationDestinationLevel, "DestinationRule db-mtls"},
		},
	},
	{
		name: "destinationrule with no cacert, simple at portlevel",
		inputFiles: []string{
			"testdata/destinationrule-simple-port.yaml",
		},
		analyzer: &destinationrule.CaCertificateAnalyzer{},

	firstEntry := entry{
		key:            "key1",
		dependentTypes: []kind.Kind{kind.Service, kind.DestinationRule},
		dependentConfigs: []ConfigHash{
			ConfigKey{Kind: kind.Service, Name: "name", Namespace: "namespace"}.HashCode(),
			ConfigKey{Kind: kind.DestinationRule, Name: "name", Namespace: "namespace"}.HashCode(),
		},
	}

	c := newTypedXdsCache[uint64]()

	cache := c.(*lruCache[uint64])

	return h.Sum64()
}

func (t *clusterCache) DependentConfigs() []model.ConfigHash {
	drs := t.destinationRule.GetFrom()
	configs := make([]model.ConfigHash, 0, len(drs)+1+len(t.envoyFilterKeys))
	if t.destinationRule != nil {
		for _, dr := range drs {
			configs = append(configs, model.ConfigKey{Kind: kind.DestinationRule, Name: dr.Name, Namespace: dr.Namespace}.HashCode())
		}
	}
	if t.service != nil {