"testdata/destinationrule-mutual-destination.yaml",
		},
		analyzer: &destinationrule.CaCertificateAnalyzer{},
		expected: []message{
			{msg.NoServerCertificateVerificationDestinationLevel, "DestinationRule db-mtls"},
		},
	},
	{
		name: "destinationrule with no cacert, simple at portlevel",
		inputFiles: []string{
			"testdata/destinationrule-simple-port.yaml",
		},
		analyzer: &destinationrule.CaCertificateAnalyzer{},

	firstEntry := entry{
		key:            "key1",
		dependentTypes: []kind.Kind{kind.Service, kind.DestinationRule},
		dependentConfigs: []ConfigHash{
			ConfigKey{Kind: kind.Service, Name: "name", Namespace: "namespace"}.HashCode(),
			ConfigKey{Kind: kind.DestinationRule, Name: "name", Namespace: "namespace"}.HashCode(),
		},
	}

	c := newTypedXdsCache[uint64]()

	cache := c.(*lruCache[uint64])

			configs: []config.Config{{
				Meta: config.Meta{
					GroupVersionKind: gvk.DestinationRule,
					Name:             "test-desinationrule",
					Namespace:        TestServiceNamespace,
				},
				Spec: destRuleWithNoSubsets,
			}},
			configUpdated:        sets.New(model.ConfigKey{Kind: kind.DestinationRule, Name: "test-desinationrule", Namespace: TestServiceNamespace}),

	return h.Sum64()
}

func (t *clusterCache) DependentConfigs() []model.ConfigHash {
	drs := t.destinationRule.GetFrom()
	configs := make([]model.ConfigHash, 0, len(drs)+1+len(t.envoyFilterKeys))
	if t.destinationRule != nil {
		for _, dr := range drs {
			configs = append(configs, model.ConfigKey{Kind: kind.DestinationRule, Name: dr.Name, Namespace: dr.Namespace}.HashCode())
		}
	}
	if t.service != nil {

	cfg := proxy.SidecarScope.DestinationRule(model.TrafficDirectionInbound, proxy, instance.Service.Hostname).GetRule()
	if cfg != nil {
		destinationRule := CastDestinationRule(cfg)
		opts.isDrWithSelector = destinationRule.GetWorkloadSelector() != nil
		if destinationRule.TrafficPolicy != nil {
			opts.policy, _ = util.GetPortLevelTrafficPolicy(destinationRule.TrafficPolicy, instance.Port.ServicePort)

	case CustomResourceDefinition:
		return "CustomResourceDefinition"
	case DNSName:
		return "DNSName"
	case DaemonSet:
		return "DaemonSet"
	case Deployment:
		return "Deployment"
	case DestinationRule:
		return "DestinationRule"
	case EndpointSlice:
		return "EndpointSlice"
	case Endpoints:
		return "Endpoints"
	case EnvoyFilter:
		return "EnvoyFilter"
	case GRPCRoute:
		return "GRPCRoute"
	case Gateway:

	}.MustBuild()

	DestinationRule = resource.Builder{
		Identifier: "DestinationRule",
		Group:      "networking.istio.io",
		Kind:       "DestinationRule",
		Plural:     "destinationrules",
		Version:    "v1alpha3",
		VersionAliases: []string{
			"v1beta1",
			"v1",
		},
		Proto: "istio.networking.v1alpha3.DestinationRule", StatusProto: "istio.meta.v1alpha1.IstioStatus",

type mtlsChecker struct {
	push            *model.PushContext
	svcPort         int
	destinationRule *networkingapi.ClientTLSSettings_TLSmode
}

func newMtlsChecker(push *model.PushContext, svcPort int, dr *config.Config, subset string) *mtlsChecker {
	return &mtlsChecker{
		push:            push,
		svcPort:         svcPort,
		destinationRule: tlsModeForDestinationRule(dr, subset, svcPort),
	}
}

# Fails if a service with the name exists: trusted_ca required !
apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
  name: ssl-simple
  namespace: testns
spec:
  host: ssl1.webinf.info
  trafficPolicy:
    loadBalancer:
      simple: LEAST_CONN
    tls:
      mode: SIMPLE
---
# This will not work: myCA not found, results in rejecting all clusters if the
# service exists.
apiVersion: networking.istio.io/v1alpha3

					},
				},
				{
					Meta: config.Meta{
						GroupVersionKind: gvk.DestinationRule,
						Name:             "mtls-on",
						Namespace:        "ns",
					},
					Spec: &networking.DestinationRule{
						Host: "example.ns.svc.cluster.local",
						TrafficPolicy: &networking.TrafficPolicy{