// Avoid using "istiod" as it is implicitly considered clusterLocal
var testSvcHost = "test.istio-system.svc.cluster.local"

// Local integration tests for proxyless gRPC.
// The tests will start an in-process Istiod, using the memory store, and use
// proxyless grpc servers and clients to validate the config generation.
// GRPC project has more extensive tests for each language, we mainly verify that Istiod

	ipAllocs map[api.IPFamily]ipallocator.Interface,
	portAlloc portallocator.Interface,
	endpoints EndpointsStorage,
	pods PodStorage,
	proxyTransport http.RoundTripper) (*REST, *StatusREST, *svcreg.ProxyREST, error) {

	store := &genericregistry.Store{
		NewFunc:                   func() runtime.Object { return &api.Service{} },
		NewListFunc:               func() runtime.Object { return &api.ServiceList{} },

func (r *Runner) EnvoyGet(namespace, pod, url string, dryRun bool) (string, error) {
	if dryRun {
		return fmt.Sprintf("Dry run: would be running client.EnvoyDo(%s, %s, %s)", pod, namespace, url), nil
	}
	task := fmt.Sprintf("ProxyGet %s/%s:%s", namespace, pod, url)
	r.addRunningTask(task)
	defer r.removeRunningTask(task)
	out, err := r.Client.EnvoyDo(context.TODO(), pod, namespace, "GET", url)
	return string(out), err
}

	"istio.io/istio/pkg/test/scopes"
	"istio.io/istio/pkg/test/util/file"
	"istio.io/istio/pkg/test/util/retry"
	"istio.io/istio/pkg/test/util/tmpl"
	"istio.io/istio/pkg/util/protomarshal"
)

const (
	// for proxyless we add a special gRPC server that doesn't get configured with xDS for test-runner use
	grpcMagicPort = 17171
	// for non-Go implementations of gRPC echo, this is the port used to forward non-gRPC requests to the Go server

				scope := t.ConfigIstio()
				if c.globalConfig {
					scope = t.ConfigKube()
				}
				return scope.YAML("", cfg).Apply()
			}).
			FromMatch(match.And(c.sourceMatchers...)).
			// TODO mainly testing proxyless features as a client for now
			ToMatch(match.And(append(c.targetMatchers, match.NotProxylessGRPC)...)).
			WithDefaultFilters(1, c.toN).
			ConditionallyTo(c.comboFilters...)

	}

	a.secretCache, err = a.newSecretManager()
	if err != nil {
		return fmt.Errorf("failed to start workload secret manager %v", err)
	}

	if a.cfg.DisableEnvoy {
		// For proxyless we don't need an SDS server, but still need the keys and
		// we need them refreshed periodically.
		//
		// This is based on the code from newSDSService, but customized to have explicit rotation.
		go func() {

          - name: GRPC_GO_LOG_SEVERITY_LEVEL
            value: info
        volumeMounts:
          - mountPath: /var/lib/grpc/data/
            name: grpc-io-proxyless-bootstrap
      {{- end }}
      volumes:
        - name: grpc-io-proxyless-bootstrap
          emptyDir: {}
  grpc-agent: |
    {{- define "resources"  }}

          - name: GRPC_GO_LOG_SEVERITY_LEVEL
            value: info
        volumeMounts:
          - mountPath: /var/lib/grpc/data/
            name: grpc-io-proxyless-bootstrap
      {{- end }}
      volumes:
        - name: grpc-io-proxyless-bootstrap
          emptyDir: {}
  grpc-agent: |
    {{- define "resources"  }}

          - name: GRPC_GO_LOG_SEVERITY_LEVEL
            value: info
        volumeMounts:
          - mountPath: /var/lib/grpc/data/
            name: grpc-io-proxyless-bootstrap
      {{- end }}
      volumes:
        - name: grpc-io-proxyless-bootstrap
          emptyDir: {}
  grpc-agent: |
    {{- define "resources"  }}

  }

  @AfterEach
  fun tearDown() {
    java.net.Authenticator.setDefault(null)
    System.clearProperty("proxyHost")
    System.clearProperty("proxyPort")
    System.clearProperty("http.proxyHost")
    System.clearProperty("http.proxyPort")
    System.clearProperty("https.proxyHost")
    System.clearProperty("https.proxyPort")
    if (cache != null) {
      cache!!.delete()
    }
  }

  @Test