"global.outboundTrafficPolicy" "meshConfig.outboundTrafficPolicy"
    "global.certificates" "meshConfig.certificates"
    "global.localityLbSetting" "meshConfig.localityLbSetting"
    "global.policyCheckFailOpen" "meshConfig.policyCheckFailOpen"
    "global.enableTracing" "meshConfig.enableTracing"
    "global.proxy.accessLogFormat" "meshConfig.accessLogFormat"
    "global.proxy.accessLogFile" "meshConfig.accessLogFile"

// limitations under the License.

package authn

import (
	meshconfig "istio.io/api/mesh/v1alpha1"
	"istio.io/istio/pilot/pkg/features"
	"istio.io/istio/pkg/util/sets"
)

func TrustDomainsForValidation(meshConfig *meshconfig.MeshConfig) []string {
	if features.SkipValidateTrustDomain {
		return nil
	}

	tds := append([]string{meshConfig.TrustDomain}, meshConfig.TrustDomainAliases...)

	opts.push = &model.PushContext{
		Mesh: &meshconfig.MeshConfig{
			EnableTracing: true,
			DefaultConfig: &meshconfig.ProxyConfig{
				Tracing: &meshconfig.Tracing{
					Sampling: 55.5,
				},
			},
			DefaultProviders: &meshconfig.MeshConfig_DefaultProviders{
				Tracing: []string{
					"foo",
				},
			},
			ExtensionProviders: []*meshconfig.MeshConfig_ExtensionProvider{
				{
					Name: "foo",

func (w *internalWatcher) HandleMeshConfig(meshConfig *meshconfig.MeshConfig) {
	w.mutex.Lock()
	defer w.mutex.Unlock()
	w.handleMeshConfigInternal(meshConfig)
}

// handleMeshConfigInternal behaves the same as HandleMeshConfig but must be called under a lock
func (w *internalWatcher) handleMeshConfigInternal(meshConfig *meshconfig.MeshConfig) {
	var handlers []*WatcherHandlerRegistration

		name                     string
		mesh                     meshconfig.MeshConfig
		expectedMTLSCipherSuites []string
	}{
		{
			name:                     "Default MTLS supported Ciphers",
			expectedMTLSCipherSuites: SupportedCiphers,
		},
		{
			name: "Configure 1 MTLS cipher suite",
			mesh: meshconfig.MeshConfig{
				MeshMTLS: &meshconfig.MeshConfig_TLSConfig{
					CipherSuites: []string{"ECDHE-RSA-AES256-GCM-SHA384"},

package authn

import (
	"reflect"
	"testing"

	meshconfig "istio.io/api/mesh/v1alpha1"
)

func TestTrustDomainsForValidation(t *testing.T) {
	tests := []struct {
		name       string
		meshConfig *meshconfig.MeshConfig
		want       []string
	}{
		{
			name: "No duplicated trust domain in mesh config",
			meshConfig: &meshconfig.MeshConfig{
				TrustDomain:        "cluster.local",

	cases := []struct {
		name   string
		config *meshconfig.MeshConfig_ExtensionProvider_ZipkinTracingProvider
		valid  bool
	}{
		{
			name: "zipkin normal",
			config: &meshconfig.MeshConfig_ExtensionProvider_ZipkinTracingProvider{
				Service: "zipkin.istio-system",
				Port:    9411,
			},
			valid: true,
		},
		{
			name: "zipkin service with namespace",
			config: &meshconfig.MeshConfig_ExtensionProvider_ZipkinTracingProvider{

	want := mesh.EmptyMeshNetworks()
	want.Networks = map[string]*meshconfig.Network{
		"network1": {
			Endpoints: []*meshconfig.Network_NetworkEndpoints{
				{
					Ne: &meshconfig.Network_NetworkEndpoints_FromCidr{
						FromCidr: "192.168.0.1/24",
					},
				},
			},
			Gateways: []*meshconfig.Network_IstioNetworkGateway{
				{
					Gw: &meshconfig.Network_IstioNetworkGateway_Address{
						Address: "1.1.1.1",

	httpbin = map[string]string{
		"app":     "httpbin",
		"version": "v1",
	}
	meshConfigGRPCNoNamespace = &meshconfig.MeshConfig{
		ExtensionProviders: []*meshconfig.MeshConfig_ExtensionProvider{
			{
				Name: "default",
				Provider: &meshconfig.MeshConfig_ExtensionProvider_EnvoyExtAuthzGrpc{
					EnvoyExtAuthzGrpc: &meshconfig.MeshConfig_ExtensionProvider_EnvoyExternalAuthorizationGrpcProvider{

	}
	return
}

func validateExtensionProviderMetricsPrometheus(_ *meshconfig.MeshConfig_ExtensionProvider_PrometheusMetricsProvider) error {
	return nil
}

func validateExtensionProviderStackdriver(_ *meshconfig.MeshConfig_ExtensionProvider_StackdriverProvider) error {
	return nil
}

func validateExtensionProviderEnvoyFileAccessLog(_ *meshconfig.MeshConfig_ExtensionProvider_EnvoyFileAccessLogProvider) error {
	return nil
}