if len(adscon.GetHTTPListeners()) != 3 {
			t.Error("HTTP listeners, expecting 3 got", len(adscon.GetHTTPListeners()), xdstest.MapKeys(adscon.GetHTTPListeners()))
		}

		// s1tcp:2000 outbound, bind=true (to reach other instances of the service)
		// s1:5005 outbound, bind=true
		// :443 - https external, bind=false
		// 10.11.0.1_7070, bind=true -> inbound|2000|s1 - on port 7070, fwd to 37070
		// virtual
		if len(adscon.GetTCPListeners()) == 0 {

apiVersion: release-notes/v2
kind: bug-fix
area: traffic-management
issue:
  - 31095
releaseNotes:
  - |

Eoin Fennessy <******@****.***> 1715615475 +0100

                {
                    "ecds_filter": {
                        "@type": "type.googleapis.com/envoy.config.core.v3.TypedExtensionConfig",
                        "name": "istio.io/telemetry/stats/prometheus/sidecar/Outbound/HTTP"
                    },
                    "last_updated": "2023-12-23T13:46:00.701Z"
                },
                {
                    "ecds_filter": {

	}

	type Outbound struct {
		ClusterName string                         `json:"clusterName"`
		IP          string                         `json:"ip"`
		Stats       []*envoy_admin_v3.SimpleMetric `json:"stats"`
	}

	type Details struct {
		From     string     `json:"from"`
		To       string     `json:"to"`
		Outbound []Outbound `json:"outbound"`
		IPs      []IPs      `json:"ips"`
	}

  # process should be kept alive after an occasional reload.
  drainDuration: 2s
  #
  # The mode used to redirect inbound connections to Envoy. This setting
  # has no effect on outbound traffic: iptables REDIRECT is always used for
  # outbound connections.
  # If "REDIRECT", use iptables REDIRECT to NAT and redirect to Envoy.
  # The "REDIRECT" mode loses source addresses during redirection.

# sidecar to intercept outbound calls to configured addresses. If not set, outbound istio sidecar
# will not be used via iptables.
# ISTIO_SERVICE_CIDR=

# Name of the service exposed by the machine.
# ISTIO_SERVICE=myservice

# The mode used to redirect inbound connections to Envoy. This setting
# has no effect on outbound traffic: iptables REDIRECT is always used for
# outbound connections.

  lastUpdated: "2022-12-08T11:03:53.225Z"
  versionInfo: 2022-12-08T09:07:09Z/10
- ecdsFilter:
    '@type': type.googleapis.com/envoy.config.core.v3.TypedExtensionConfig
    name: istio.io/telemetry/stats/prometheus/sidecar/Outbound/HTTP
  lastUpdated: "2023-12-23T13:46:00.701Z"
- ecdsFilter:
    '@type': type.googleapis.com/envoy.config.core.v3.TypedExtensionConfig
    name: istio.io/telemetry/stats/prometheus/sidecar/Inbound/HTTP

			},
		})
		proxy := s.SetupProxy(baseProxy())

		endpoints := xdstest.ExtractLoadAssignments(s.Endpoints(proxy))
		if !slices.EqualUnordered(endpoints["outbound|80||app.com"], []string{"1.1.1.1:80"}) {
			t.Fatalf("expected 1.1.1.1, got %v", endpoints["outbound|80||app.com"])
		}

		assertListEqual(t, xdstest.ExtractListenerNames(s.Listeners(proxy)), []string{
			"0.0.0.0_80",
			"5.5.5.5_443",
			"virtualInbound",

    value:
      stringMatch:
        prefix: istio-ext-authz
  grpcService:
    envoyGrpc:
      authority: my-custom-ext-authz.foo.svc.cluster.local
      clusterName: outbound|9000||my-custom-ext-authz.foo.svc.cluster.local
    timeout: 0.002s
  statusOnError:
    code: Forbidden
  transportApiVersion: V3
  withRequestBody:
    allowPartialMessage: true