}
	return host + k8sSuffix
}

// getDestRuleSubsets gets names of subsets that match any pod labels (also, ones that don't match).
func getDestRuleSubsets(subsets []*v1alpha3.Subset, podsLabels []klabels.Set) ([]string, []string) {
	matchingSubsets := make([]string, 0, len(subsets))
	nonmatchingSubsets := make([]string, 0, len(subsets))
	for _, subset := range subsets {
		subsetSelector := klabels.SelectorFromSet(subset.Labels)

apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
  name: tunnel-outbound-traffic-to-external-svc-via-external-forward-proxy
spec:
  host: external-forward-proxy.{{ .externalNamespace }}.svc.cluster.local
  subsets:
  - name: external-svc-tcp
    trafficPolicy:
      tunnel:
        targetHost: external.{{ .externalNamespace }}
        targetPort: {{ .externalSvcTcpPort }}
  - name: external-svc-tls
    trafficPolicy:

        "apiVersion": "apiVersionValue",
        "time": "2004-01-01T01:01:01Z",
        "fieldsType": "fieldsTypeValue",
        "fieldsV1": {},
        "subresource": "subresourceValue"
      }
    ]
  },
  "subsets": [
    {
      "addresses": [
        {
          "ip": "ipValue",
          "hostname": "hostnameValue",
          "nodeName": "nodeNameValue",
          "targetRef": {
            "kind": "kindValue",

    blockOwnerDeletion: true
    controller: true
    kind: kindValue
    name: nameValue
    uid: uidValue
  resourceVersion: resourceVersionValue
  selfLink: selfLinkValue
  uid: uidValue
subsets:
- addresses:
  - hostname: hostnameValue
    ip: ipValue
    nodeName: nodeNameValue
    targetRef:
      apiVersion: apiVersionValue
      fieldPath: fieldPathValue
      kind: kindValue

	if key != config.Default {
		envName = envName + config.Default + key
	}
	return env.Get(envName, defaultValue)
}

func lookupLegacyConfigForSubSys(ctx context.Context, subSys string) Config {
	cfg := NewConfig()
	switch subSys {
	case config.LoggerWebhookSubSys:
		var loggerTargets []string
		envs := env.List(legacyEnvLoggerHTTPEndpoint)
		for _, k := range envs {

{{- $subsets := .Subsets }}
{{- $cluster := .Cluster }}
{{- range $i, $subset := $subsets }}
apiVersion: apps/v1
kind: Deployment
metadata:
  name: {{ $.Service }}-{{ $subset.Version }}
spec:
  replicas: 1
  selector:
    matchLabels:
      istio.io/test-vm: {{ $.Service }}
      istio.io/test-vm-version: {{ $subset.Version }}
  template:
    metadata:
      annotations:

func ValidateServiceSubnetSize(subnetStr string, fldPath *field.Path) field.ErrorList {
	allErrs := field.ErrorList{}
	// subnets were already validated
	subnets, _ := netutils.ParseCIDRs(strings.Split(subnetStr, ","))
	for _, serviceSubnet := range subnets {
		ones, bits := serviceSubnet.Mask.Size()
		if bits-ones > constants.MaximumBitsForServiceSubnet {

		storage:   s,
		destroyFn: func() {},
		baseKey:   base,
		leaseTime: 1 * time.Minute, // avoid the lease to timeout on tests
	}}
}

func (f *peerEndpointLeaseReconciler) SetKeys(servers []serverInfo) error {
	for _, server := range servers {
		if err := f.UpdateLease(server.id, server.existingIP, server.ports); err != nil {
			return err
		}
	}
	return nil
}

	naked1 = &fakeInstance{Cluster: cls1, Namespace: namespace.Static("echo"), Service: "naked", Subsets: []echo.SubsetConfig{{
		Annotations: map[string]string{annotation.SidecarInject.Name: "false"},
	}}}
	// external svc
	external1 = &fakeInstance{
		Cluster: cls1, Namespace: namespace.Static("echo"), Service: "external", DefaultHostHeader: "external.com", Subsets: []echo.SubsetConfig{{
			Annotations: map[string]string{annotation.SidecarInject.Name: "false"},

func TestSubSysNotificationTargets(ctx context.Context, cfg config.Config, subSys string, transport *http.Transport) error {
	if err := checkValidNotificationKeysForSubSys(subSys, cfg[subSys]); err != nil {
		return err
	}

	targetList, err := fetchSubSysTargets(ctx, cfg, subSys, transport)
	if err != nil {
		return err
	}

	for _, target := range targetList {
		defer target.Close()
	}