// kube-inject. Instead, we just compare the desired/actual pod specs.
			t.Run("webhook", func(t *testing.T) {
				env := &model.Environment{}
				env.SetPushContext(&model.PushContext{
					ProxyConfigs: &model.ProxyConfigs{},
				})

				multi := multicluster.NewFakeController()
				client := kube.NewFakeClient(
					&corev1.Namespace{
						ObjectMeta: metav1.ObjectMeta{

	}
	return results
}

func (e *EcdsGenerator) SetCredController(creds credscontroller.MulticlusterController) {
	e.secretController = creds
}

func referencedSecrets(proxy *model.Proxy, push *model.PushContext, resourceNames []string) []SecretResource {
	// The requirement for the Wasm pull secret:
	// * Wasm pull secrets must be of type `kubernetes.io/dockerconfigjson`.

	subsetName   string
	subsetLabels labels.Instance
	hostname     host.Name
	port         int
	push         *model.PushContext
	proxy        *model.Proxy
	dir          model.TrafficDirection

	mtlsChecker *mtlsChecker
}

func NewEndpointBuilder(clusterName string, proxy *model.Proxy, push *model.PushContext) EndpointBuilder {
	dir, subsetName, hostname, port := model.ParseSubsetKey(clusterName)

// All operations are thread safe.
type XdsCache interface {
	// Run starts a background thread to flush evicted indexes periodically.
	Run(stop <-chan struct{})
	// Add adds the given XdsCacheEntry with the value for the given pushContext to the cache.
	// If the cache has been updated to a newer push context, the write will be dropped silently.
	// This ensures stale data does not overwrite fresh data when dealing with concurrent
	// writers.

type gatewayListenerOpts struct {
	push  *model.PushContext
	proxy *model.Proxy

	bindToPort bool
	bind       string
	extraBind  []string

	port              int
	filterChainOpts   []*filterChainOpts
	needPROXYProtocol bool
}

// outboundListenerOpts are the options to build an outbound listener
type outboundListenerOpts struct {
	push  *model.PushContext
	proxy *model.Proxy

	case istionetworking.TransportProtocolQUIC:
		return "udp_" + bind + "_" + strconv.Itoa(port)
	}
	return "unknown"
}

func buildNameToServiceMapForHTTPRoutes(node *model.Proxy, push *model.PushContext,
	virtualService config.Config,
) map[host.Name]*model.Service {
	vs := virtualService.Spec.(*networking.VirtualService)
	nameToServiceMap := map[host.Name]*model.Service{}

func GetConsistentHashForVirtualService(push *model.PushContext, node *model.Proxy, virtualService config.Config) DestinationHashMap {
	hashByDestination, _ := hashForVirtualService(push, node, virtualService)
	return hashByDestination
}

// hashForHTTPDestination return the ConsistentHashLB and the DestinationRule associated with HTTP route destination.
func hashForHTTPDestination(push *model.PushContext, node *model.Proxy,

				})
			}
			cg := core.NewConfigGenTest(t, core.TestOptions{
				Services:  services,
				Instances: instances,
			})
			kr := splitInput(t, input)
			kr.Context = NewGatewayContext(cg.PushContext(), "Kubernetes")
			output := convertResources(kr)
			output.AllowedReferences = AllowedReferences{} // Not tested here
			output.ReferencedNamespaceKeys = nil           // Not tested here

	return strings.Join(match.SniHosts, ",") + "|" + strings.Join(match.DestinationSubnets, ",")
}

func buildSidecarOutboundTLSFilterChainOpts(node *model.Proxy, push *model.PushContext, destinationCIDR string,
	service *model.Service, bind string, listenPort *model.Port,
	gateways sets.String, configs []config.Config,
) []*filterChainOpts {
	if !listenPort.Protocol.IsTLS() {
		return nil
	}

	dnsProto "istio.io/istio/pkg/dns/proto"
	netutil "istio.io/istio/pkg/util/net"
)

// Config for building the name table.
type Config struct {
	Node *model.Proxy
	Push *model.PushContext

	// MulticlusterHeadlessEnabled if true, the DNS name table for a headless service will resolve to
	// same-network endpoints in any cluster.
	MulticlusterHeadlessEnabled bool
}