issue:
  - 27994

releaseNotes:
  - |
    **Added** support of PeerAuthentication per-port-level configuration on pass through filter chains.

upgradeNotes:
  - title: PeerAuthentication per-port-level configuration will now also apply to pass through filter chains.
    content: |
      Previously the PeerAuthentication per-port-level configuration is ignored if the port number is not defined in a

	// nolint: govet
	out := *s
	out.Attributes = s.Attributes.DeepCopy()
	if s.Ports != nil {
		out.Ports = make(PortList, len(s.Ports))
		for i, port := range s.Ports {
			if port != nil {
				out.Ports[i] = &Port{
					Name:     port.Name,
					Port:     port.Port,
					Protocol: port.Protocol,
				}
			} else {
				out.Ports[i] = nil
			}
		}
	}

	if s.ServiceAccounts != nil {

					cases := []struct {
						ports []echo.Port
						path  string
						allow allowValue
					}{
						{
							ports: []echo.Port{ports.GRPC, ports.TCP},
							allow: allow,
						},
						{
							ports: []echo.Port{ports.HTTP, ports.HTTP2},
							path:  "/allow",
							allow: allow,
						},
						{
							ports: []echo.Port{ports.HTTP, ports.HTTP2},
							path:  "/allow?param=value",

spec:
  selector:
    app: my-service
  ports:
  - name: tcp-foo
    protocol: TCP
    port: 8080
    targetPort: 8080
---
# Service with extra port in cluster2, should generate warning.
apiVersion: v1
kind: Service
metadata:
  name: extra-port
  namespace: my-namespace
spec:
  selector:
    app: my-service
  ports:
  - name: tcp-foo
    protocol: TCP
    port: 8080
    targetPort: 8080

metadata:
  name: reviews-v1
spec:
  ports:
  - port: 9080
    name: http
  selector:
    app: reviews
    version: v1
---
apiVersion: v1
kind: Service
metadata:
  name: reviews-v2
spec:
  ports:
  - port: 9080
    name: http
  selector:
    app: reviews
    version: v2
---
apiVersion: v1
kind: Service
metadata:
  name: reviews-v3
spec:
  ports:
  - port: 9080
    name: http
  selector:

metadata:
  name: conflicting-ports-1
  namespace: bookinfo
  labels:
    app: conflicting-ports
spec:
  ports:
    - port: 9080
      name: tcp
      targetPort: 9080
      protocol: TCP
  selector:
    app: conflicting-ports
---
apiVersion: v1
kind: Service
metadata:
  name: conflicting-ports-2
  namespace: bookinfo
  labels:
    app: conflicting-ports
spec:
  ports:

			ports = append(ports, int(v.Port()))
		}
	}
	if len(addrs) > 0 {
		return addrs, ports, nil
	}

	return nil, nil, fmt.Errorf("failed to get address for port %v", port)
}

// AddressForPort returns the externally reachable host and port of the component for the given port.
func (c *ingressImpl) AddressesForPort(port int) ([]string, []int) {
	addrs, ports, err := c.getAddressesInner(port)

			port := model.ServiceInstancePort{
				ServicePort: &model.Port{
					Name:     i.Port.Name,
					Port:     int(i.Port.Number),
					Protocol: protocol.Parse(i.Port.Protocol),
				},
				TargetPort: i.Port.Number, // No targetPort support in the API
			}
			bindtoPort := getBindToPort(i.CaptureMode, lb.node)
			// Skip ports we cannot bind to

			}},
			expected: []string{
				`spec.containers[0].ports[2]: duplicate port definition with spec.containers[0].ports[0]`,
				`spec.containers[1].ports[0]: duplicate port definition with spec.containers[0].ports[0]`,
				`spec.containers[1].ports[0]: duplicate port definition with spec.containers[0].ports[2]`,
				`spec.containers[1].ports[1]: duplicate port definition with spec.containers[0].ports[0]`,

	}

	svcPorts := make(model.PortList, 0, len(ports))
	for name, port := range ports {
		svcPort := &model.Port{
			Name:     name,
			Port:     port,
			Protocol: convertPortNameToProtocol(name),
		}
		svcPorts = append(svcPorts, svcPort)
	}

	sortPorts(svcPorts)
	svc.Ports = svcPorts
	return svc
}