spec:
  hosts:
  - example.com
  ports:
  - number: 80
    name: http
    protocol: HTTP
  resolution: STATIC
  location: MESH_INTERNAL
  endpoints:
  - address: 1.1.1.1
    labels:
      security.istio.io/tlsMode: istio
---
# Set up .Services number of services.
{{- range $i := until .Services }}
apiVersion: networking.istio.io/v1alpha3
kind: ServiceEntry
metadata:
  name: service-{{$i}}
spec:
  addresses:

apiVersion: networking.istio.io/v1beta1
kind: DestinationRule
metadata:
  name: "{{ .To.ServiceName }}"
spec:
  host: "{{ .To.ClusterLocalFQDN }}"
  trafficPolicy:
    tls:

		},
	}

	cases := []struct {
		name    string
		tlsMode networking.ClientTLSSettings_TLSmode
		meta    *core.Metadata
		want    *core.Metadata
	}{
		{
			name:    "ISTIO_MUTUAL TLS",
			tlsMode: networking.ClientTLSSettings_ISTIO_MUTUAL,
			meta:    nil,
			want:    nil,
		},
		{
			name:    "DISABLED TLS",
			tlsMode: networking.ClientTLSSettings_DISABLE,
			meta:    nil,
			want:    nil,

		Endpoint: &model.IstioEndpoint{
			Address:        "2.2.2.2",
			Labels:         map[string]string{"app": "wle"},
			ServiceAccount: spiffe.MustGenSpiffeURIForTrustDomain("cluster.local", selector.Name, "default"),
			TLSMode:        model.IstioMutualTLSModeLabel,
		},
	}

	wi2 := &model.WorkloadInstance{
		Name:      "some-other-name",
		Namespace: selector.Namespace,
		Endpoint: &model.IstioEndpoint{
			Address:        "3.3.3.3",

apiVersion: networking.istio.io/v1beta1
kind: DestinationRule
metadata:
  name: "default"
spec:
  host: "*"
  trafficPolicy:
    tls:
      mode: {{ .TLSMode }}
---
# Apply a local policy to the system namespace to turn this off
# Otherwise, the eastwest gateway will be impacted
apiVersion: networking.istio.io/v1beta1
kind: DestinationRule
metadata:
  name: "eastwest-opt-out"
spec:
  exportTo: [.]
  host: "*"

    - example.com
  ports:
    - number: 80
      name: http
      protocol: HTTP
  resolution: STATIC
  location: MESH_INTERNAL
  endpoints:
    - address: 1.1.1.1
      labels:
        security.istio.io/tlsMode: istio
{{- range $i := until .Services }}
---
apiVersion: v1
kind: Service
metadata:
  name: service-{{$i}}
spec:
  type: ExternalName
  externalName: random-{{$i}}.example.com
  ports:
    - port: 80

                }
              }
            ],
            "transport_socket_matches": [
              {
                "name": "tlsMode-istio",
                "match": {
                  "tlsMode": "istio"
                },
                "transport_socket": {
                  "name": "envoy.transport_sockets.tls",
                  "typed_config": {

spec:
  replicas: 7
  selector:
    matchLabels:
      app: hello
      tier: backend
      track: stable
  template:
    metadata:
      labels:
        app: hello
        security.istio.io/tlsMode: "disabled"
        tier: backend
        track: stable
    spec:
      containers:
        - name: hello
          image: "fake.docker.io/google-samples/hello-go-gke:1.0"
          ports:
            - name: http

      protocol: HTTPS
    - number: 9090
      name: auto
      protocol: ""
  resolution: STATIC
  location: MESH_INTERNAL
  endpoints:
    - address: 1.1.1.1
      labels:
        security.istio.io/tlsMode: istio
---
# Set up .Services number of services. Each will have 4 ports (one for each protocol)
{{- range $i := until .Services }}
apiVersion: networking.istio.io/v1alpha3
kind: ServiceEntry
metadata:

			DnsLookupFamily: cluster.Cluster_V4_ONLY,
			LbPolicy:        cluster.Cluster_ROUND_ROBIN,
			TransportSocketMatches: []*cluster.Cluster_TransportSocketMatch{
				{
					Name: "tlsMode-istio",
					TransportSocket: &core.TransportSocket{
						Name: "envoy.transport_sockets.tls",
						ConfigType: &core.TransportSocket_TypedConfig{
							TypedConfig: protoconv.MessageToAny(&tls.UpstreamTlsContext{