patches := fuzz.Slice[*networking.EnvoyFilter_EnvoyConfigObjectPatch](fg, patchCount%30)
		proxy := fuzz.Struct[*model.Proxy](fg)
		mesh := fuzz.Struct[*meshconfig.MeshConfig](fg)
		c := fuzz.Struct[*cluster.Cluster](fg)

		serviceDiscovery := memory.NewServiceDiscovery()
		env := newTestEnvironment(serviceDiscovery, mesh, buildEnvoyFilterConfigStore(patches))
		push := model.NewPushContext()
		push.InitContext(env, nil, nil)

	}
}

func TestSidecarStatefulsessionFilter(t *testing.T) {
	virtualServiceSpec := &networking.VirtualService{
		Hosts:    []string{"test-service.default.svc.cluster.local", "test-service.svc.mesh.acme.net"},
		Gateways: []string{"mesh"},
		Http: []*networking.HTTPRoute{
			{
				Route: []*networking.HTTPRouteDestination{
					{
						Destination: &networking.Destination{
							Host: "test-service.default.svc.cluster.local",

						},
					},
				},
			}

			mesh := mesh.DefaultMeshConfig()
			mesh.IngressControllerMode = c.ingressMode

			if c.annotation != "" {
				ing.Annotations["kubernetes.io/ingress.class"] = c.annotation
			}

			if c.shouldProcess != shouldProcessIngressWithClass(mesh, &ing, c.ingressClass) {
				t.Errorf("got %v, want %v",
					!c.shouldProcess, c.shouldProcess)

    #
    # If an administrator expects that any of these conditions may become true in
    # the future, they should ensure their meshes have different Mesh IDs
    # assigned.
    #
    # Within a multicluster mesh, each cluster must be (manually or auto)
    # configured to have the same Mesh ID value. If an existing cluster 'joins' a

		{ // case 2
			Args: strings.Split(
				"--meshConfigFile testdata/mesh-config.yaml"+
					" --injectConfigFile testdata/inject-config.yaml -f testdata/deployment/hello.yaml"+
					" --valuesFile testdata/inject-values.yaml",
				" "),
			GoldenFilename: "testdata/deployment/hello.yaml.injected",
		},
		{ // case 3
			Args: strings.Split(
				"--meshConfigFile testdata/mesh-config.yaml"+

	wrappers "google.golang.org/protobuf/types/known/wrapperspb"

	meshconfig "istio.io/api/mesh/v1alpha1"
	networking "istio.io/api/networking/v1alpha3"
	"istio.io/istio/pilot/pkg/config/memory"
	"istio.io/istio/pilot/pkg/model"
	memregistry "istio.io/istio/pilot/pkg/serviceregistry/memory"
	"istio.io/istio/pkg/config"
	"istio.io/istio/pkg/config/mesh"
	"istio.io/istio/pkg/config/protocol"
	"istio.io/istio/pkg/config/schema/collections"

package inject

import (
	"fmt"
	"net/netip"
	"strconv"
	"strings"

	"github.com/hashicorp/go-multierror"

	"istio.io/api/annotation"
	meshconfig "istio.io/api/mesh/v1alpha1"
	"istio.io/istio/pilot/pkg/model"
	"istio.io/istio/pkg/config/mesh"
	"istio.io/istio/pkg/config/validation/agent"
	"istio.io/istio/pkg/util/protomarshal"
)

type annotationValidationFunc func(value string) error

				{
					Type:    corev1.NodeExternalIP,
					Address: nodeIP,
				},
			},
		},
	},
}

func fakeMeshHolder(ingressService string) mesh.Watcher {
	config := mesh.DefaultMeshConfig()
	config.IngressService = ingressService
	return mesh.NewFixedWatcher(config)
}

func makeStatusSyncer(t *testing.T, name string) *StatusSyncer {
	client := kubelib.NewFakeClient(testObjects...)

  kubectl -n istio-system get cm istio -o jsonpath="{.data.mesh}" > /tmp/mesh.yaml
  kubectl -n istio-system get cm istio-sidecar-injector -o jsonpath="{.data.values}" > /tmp/values.json

  # Use kube-inject based on captured configuration
  istioctl kube-inject -f samples/bookinfo/platform/kube/bookinfo.yaml \
    --injectConfigFile /tmp/inj-template.tmpl \
    --meshConfigFile /tmp/mesh.yaml \
    --valuesFile /tmp/values.json
`,

type RemoteKubeClientGetter func(clusterID cluster.ID) kubernetes.Interface

// KubeJWTAuthenticator authenticates K8s JWTs.
type KubeJWTAuthenticator struct {
	// holder of a mesh configuration for dynamically updating trust domain
	meshHolder mesh.Holder

	// Primary cluster kube client
	kubeClient kubernetes.Interface
	// Primary cluster ID
	clusterID cluster.ID

	// remote cluster kubeClient getter