config.IPFamilies = "IPv6, IPv4"
		config.IPFamilyPolicy = "RequireDualStack"
	}
	return b.WithConfig(config)
}

func (e *External) LoadValues(echos echo.Instances) {
	e.All = match.ServiceName(echo.NamespacedName{Name: ExternalSvc, Namespace: e.Namespace}).GetMatches(echos)

	MeshExternal bool

	// ResourceVersion represents the internal version of this object.
	ResourceVersion string
}

func (s *Service) NamespacedName() types.NamespacedName {
	return types.NamespacedName{Name: s.Attributes.Name, Namespace: s.Attributes.Namespace}
}

func (s *Service) Key() string {
	if s == nil {
		return ""
	}

	ConfigMapNames := krt.NewSingleton[string](
		func(ctx krt.HandlerContext) *string {
			cms := krt.Fetch(ctx, ConfigMaps)
			return ptr.Of(slices.Join(",", slices.Map(cms, func(c *corev1.ConfigMap) string {
				return config.NamespacedName(c).String()
			})...))
		},
	)
	ConfigMapNames.AsCollection().Synced().WaitUntilSynced(stop)
	tt := assert.NewTracker[string](t)
	ConfigMapNames.Register(TrackerHandler[string](tt))
	tt.WaitOrdered("add/")

// HasSynced returns whether the underlying cache has synced and the callback has been called at least once.
func (c *Controller) HasSynced() bool {
	return c.queue.HasSynced()
}

func (c *Controller) processItem(name types.NamespacedName) error {
	cm := c.configmaps.Get(name.Name, name.Namespace)
	c.callback(cm)

	c.hasSynced.Store(true)
	return nil

}

func NewTagWatcher(client kube.Client, revision string) TagWatcher {
	p := &tagWatcher{
		revision: revision,
	}
	p.queue = controllers.NewQueue("tag", controllers.WithReconciler(func(key types.NamespacedName) error {
		p.notifyHandlers()
		return nil
	}))
	p.webhooks = kclient.NewFiltered[*admissionregistrationv1.MutatingWebhookConfiguration](client, kubetypes.Filter{

	}
	p.setInitialized(true)
	p.syncRunner = async.NewBoundedFrequencyRunner("test-sync-runner", p.syncProxyRules, 0, time.Minute, 1)
	return p
}

func makeNSN(namespace, name string) types.NamespacedName {
	return types.NamespacedName{Namespace: namespace, Name: name}
}

func makeServiceMap(proxier *Proxier, allServices ...*v1.Service) {
	for i := range allServices {
		proxier.OnServiceAdd(allServices[i])
	}

}

func newAdsConnections() *adsConnections {
	return &adsConnections{byProxy: map[proxyKey]map[string]connection{}}
}

func (m *adsConnections) ConnectionsForGroup(wg types.NamespacedName) []connection {
	// collect the proxies that should be disconnected (don't remove them, OnDisconnect will)
	m.Lock()
	defer m.Unlock()
	var conns []connection
	for key, connections := range m.byProxy {

			scope.Infof("Watching a change for istio resource: %s/%s", a.GetNamespace(), a.GetName())
			return []reconcile.Request{
				{NamespacedName: types.NamespacedName{
					Name:      a.GetLabels()[helmreconciler.OwningResourceName],
					Namespace: a.GetLabels()[helmreconciler.OwningResourceNamespace],
				}},
			}
		})

	_ ingress.Instance = &ingressImpl{}
	_ io.Closer        = &ingressImpl{}
)

type ingressConfig struct {
	// Service is the kubernetes Service name for the cluster
	Service types.NamespacedName
	// LabelSelector is the value for the label on the ingress kubernetes objects
	LabelSelector string

	// Cluster to be used in a multicluster environment
	Cluster cluster.Cluster
}

						id, c.certChain, v, i)
				}
			}

		}
	}
}

func TestCreateCertificateE2EWithImpersonateIdentity(t *testing.T) {
	allowZtunnel := sets.Set[types.NamespacedName]{
		{Name: "ztunnel", Namespace: "istio-system"}: {},
	}
	ztunnelCaller := security.KubernetesInfo{
		PodName:           "ztunnel-a",
		PodNamespace:      "istio-system",
		PodUID:            "12345",