// See the License for the specific language governing permissions and
// limitations under the License.

package xds

import (
	discovery "github.com/envoyproxy/go-control-plane/envoy/service/discovery/v3"

	"istio.io/istio/pilot/pkg/model"
	"istio.io/istio/pilot/pkg/util/protoconv"
	v3 "istio.io/istio/pilot/pkg/xds/v3"
	"istio.io/istio/pkg/config/schema/kind"
	"istio.io/istio/pkg/util/sets"
)

type WorkloadGenerator struct {

	"istio.io/istio/pilot/pkg/networking/util"
	"istio.io/istio/pilot/pkg/security/authn"
	authzmodel "istio.io/istio/pilot/pkg/security/authz/model"
	"istio.io/istio/pilot/pkg/util/protoconv"
	xdsfilters "istio.io/istio/pilot/pkg/xds/filters"
	"istio.io/istio/pkg/istio-agent/grpcxds"
	"istio.io/istio/pkg/util/sets"
)

var supportedFilters = []*hcm.HttpFilter{
	xdsfilters.Fault,
	xdsfilters.BuildRouterFilter(xdsfilters.RouterFilterContext{

          readOnlyRootFilesystem: false
      - name: app
        image: testing.hub/app:latest
        imagePullPolicy: Always
        args:
          - --metrics=15014
          - --cluster=cluster-0
          - --xds-grpc-server=7070
          - --port=8080
          - --port=3333
          - --grpc=17171
          - --bind-localhost=17171
          - --version=bar
          - --istio-version=
          - --crt=/cert.crt

)

// EvaluateListenerFilterPredicates runs through the ListenerFilterChainMatchPredicate logic
// This is exposed for testing only, and should not be used in XDS generation code
func EvaluateListenerFilterPredicates(predicate *listener.ListenerFilterChainMatchPredicate, port int) bool {
	if predicate == nil {
		return true
	}
	switch r := predicate.Rule.(type) {

func PushXds[T any](xds model.XDSUpdater, f func(T) model.ConfigKey) func(events []krt.Event[T], initialSync bool) {
	return func(events []krt.Event[T], initialSync bool) {
		cu := sets.New[model.ConfigKey]()
		for _, e := range events {
			for _, i := range e.Items() {
				cu.Insert(f(i))
			}
		}
		xds.ConfigUpdate(&model.PushRequest{
			Full:           false,

package istio.networking.nds.v1;

option go_package = "istio.io/istio/pkg/dns/proto/istio_networking_nds_v1";

// Table of hostnames and their IPs to br used for DNS resolution at the agent
// Sent by istiod to istio agents via xds
message NameTable {
    message NameInfo {
        // List of IPs for the host.
        repeated string ips = 1;

        // The name of the service registry containing the service (e.g. 'Kubernetes').

	pc.CreateOrUpdateStatus(pod1)
	fx.WaitOrFail(t, "xds")

	pod2 := generatePod("127.0.0.2", "pod2", testNS, "sa2", "node1", map[string]string{"app": "a"}, nil)
	pc.CreateOrUpdateStatus(pod2)
	fx.WaitOrFail(t, "xds")

	sc.CreateOrUpdate(generateService("svc1", testNS, map[string]string{}, // labels
		map[string]string{}, // annotations
		[]int32{80},

// PtraceRegs386 is the registers used by 386 binaries.
type PtraceRegs386 struct {
	Ebx      int32
	Ecx      int32
	Edx      int32
	Esi      int32
	Edi      int32
	Ebp      int32
	Eax      int32
	Xds      int32
	Xes      int32
	Xfs      int32
	Xgs      int32
	Orig_eax int32
	Eip      int32
	Xcs      int32
	Eflags   int32
	Esp      int32
	Xss      int32
}

metadata:
  name: concrete
  namespace: default
spec:
  clusterIP: 1.2.3.4
  ports:` + ports
	runSimulationTest(t, nil, xds.FakeOptions{}, simulationTest{
		kubeConfig: service,
		calls:      calls,
	})

	// HTTP Routes
	runSimulationTest(t, nil, xds.FakeOptions{}, simulationTest{
		config: `apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: alias
spec:

// limitations under the License.

package xds

import (
	"fmt"
	"math/rand"
	"reflect"
	"testing"
	"time"

	discovery "github.com/envoyproxy/go-control-plane/envoy/service/discovery/v3"
	"go.uber.org/atomic"
	anypb "google.golang.org/protobuf/types/known/anypb"

	"istio.io/istio/pilot/pkg/model"
	"istio.io/istio/pilot/pkg/xds/endpoints"
	"istio.io/istio/pkg/config"