InitialResourceVersions: map[string]string{
			"outbound|80||test-1.default":               "",
			"outbound|8080||eds.test.svc.cluster.local": "",
		},
	})
	assertResources(resp, "outbound|8080||eds.test.svc.cluster.local", "outbound|8080||eds2.test.svc.cluster.local")
	assert.Equal(t, resp.RemovedResources, []string{"outbound|80||test-1.default"})

	// Another removal should behave the same

				// match no VS, get default config
				"alt-known.default.svc.cluster.local": {"outbound|80||alt-known.default.svc.cluster.local"},
				"known.default.svc.cluster.local":     {"outbound|80||known.default.svc.cluster.local"},
				// Wildcard doesn't match any known services, insert it as-is
				"*.unknown.example.com": {"outbound|80||arbitrary.example.com"},
			},
		},
		{
			name: "wildcard match with sidecar",

Ben Leggett <******@****.***> 1710179183 -0400

Eoin Fennessy <******@****.***> 1715615475 +0100

			ApplicationProtocols: mtlsTCPWithMxcALPNs,
			// If client sends mTLS traffic, transport protocol will be set by the TLS inspector
			TransportProtocol: xdsfilters.TLSTransportProtocol,
			Protocol:          networking.ListenerProtocolTCP,
			TLS:               true,
		},
		{
			// client side traffic could not be identified by the outbound listener, sent over plaintext

			watchedResourceNames: []string{"outbound|8080|subset-1|test.com", "outbound|8080|subset-2|test.com", "outbound|8080||test.com"},
			usedDelta:            true,
			removedClusters:      []string{"outbound|8080|subset-1|test.com"},
			expectedClusters: []string{
				"BlackHoleCluster", "InboundPassthroughCluster", "PassthroughCluster",
				"outbound|8080|subset-2|test.com", "outbound|8080||test.com",
			},
		},
		{

            "name": "outbound|9080|v1|productpage.default.svc.cluster.local",
            "type": "EDS",
            "eds_cluster_config": {
              "eds_config": {
                "ads": {},
                "initial_fetch_timeout": "0s",
                "resource_api_version": "V3"
              },
              "service_name": "outbound|9080|v1|productpage.default.svc.cluster.local"
            },

istio.io/telemetry/stats/prometheus/sidecar/Inbound/HTTP      
istio.io/telemetry/stats/prometheus/sidecar/Inbound/TCP       
istio.io/telemetry/stats/prometheus/sidecar/Outbound/HTTP     
istio.io/telemetry/stats/prometheus/sidecar/Outbound/TCP      
default.display-metadata                                      envoy.extensions.filters.http.wasm.v3.Wasm

				cfg.ProxyGID = "1,2"
				cfg.ProxyUID = "3,4"
			},
		},
		{
			"outbound-owner-groups",
			func(cfg *config.Config) {
				cfg.OwnerGroupsInclude = "java,202"
			},
		},
		{
			"outbound-owner-groups-exclude",
			func(cfg *config.Config) {
				cfg.OwnerGroupsExclude = "888,ftp"
			},
		},
		{
			"ipv6-dns-outbound-owner-groups",
			func(cfg *config.Config) {
				cfg.EnableIPv6 = true

kind: bug-fix
area: traffic-management
issue:
  - 46719
releaseNotes:
  - |
    **Added** gated flag `ISTIO_ENABLE_IPV4_OUTBOUND_LISTENER_FOR_IPV6_CLUSTERS` to manage an additional outbound listener for IPv6-only clusters to deal with IPv4 NAT outbound traffic.