test.SetForTest(t, &features.EnableAmbient, true)
	testNS := "test"
	systemNS := "istio-system"

	s, fx := NewFakeControllerWithOptions(t, FakeControllerOptions{
		SystemNamespace: systemNS,
		NetworksWatcher: mesh.NewFixedNetworksWatcher(nil),
	})

	tracker := assert.NewTracker[string](t)

	s.namespaces.AddEventHandler(controllers.ObjectHandler(func(o controllers.Object) {

	ns := "istio-system"
	i, err := istio.Get(b.ctx)
	if err != nil {
		scopes.Framework.Infof("defaulting to istio-system namespace for injection template discovery: %v", err)
	} else {
		ns = i.Settings().SystemNamespace
	}

	out := map[string]sets.String{}
	for _, c := range b.ctx.Clusters() {
		out[c.Name()] = sets.New[string]()
		// TODO find a place to read revision(s) and avoid listing

		"Mode":           destinationRuleMode,
		"CredentialName": credentialName,
	}

	// Get namespace for gateway pod.
	istioCfg := istio.DefaultConfigOrFail(t, t)
	systemNS := namespace.ClaimOrFail(t, t, istioCfg.SystemNamespace)

	dr := `
apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
  name: originate-tls-for-server-sds-{{.CredentialName}}
spec:
  host: "{{ .to.Config.ClusterLocalFQDN }}"

	}
	details := Details{
		From: from.Config().Cluster.Name(),
		To:   address,
	}

	destName := to.Config().Service
	destNS := to.Config().Namespace.Name()
	istioNS := istio.GetOrFail(t, t).Settings().SystemNamespace

	for _, c := range t.Clusters() {
		info := IPs{
			Cluster: c.StableName(),
		}

		// Get pod IPs for service B.
		pods, err := c.PodsForSelector(context.TODO(), destNS, "app="+destName)

	framework.NewTest(t).
		RequiresSingleCluster().
		RequiresLocalControlPlane().
		Run(func(t framework.TestContext) {
			c := t.Clusters().Default()
			podIPs, err := i.PodIPsFor(c, i.Settings().SystemNamespace, "app=istio-ingressgateway")
			if err != nil {
				t.Fatalf("error getting ingress gateway pod ips: %v", err)
			}
			for _, ip := range podIPs {

| -istio.test.kube.deployEastWestGW | bool | Deploy Istio east west gateway into the target Kubernetes environment. (default true). |
| -istio.test.kube.systemNamespace | string | The namespace where the Istio components reside in a typical deployment. (default "istio-system"). |
| -istio.test.kube.helm.values | string | Manual overrides for Helm values file. Only valid when deploying Istio. |

	if err != nil {
		log.Warnf("VM config failed to get Istio component for %s: %v", cfg.Cluster.Name(), err)
		return
	}

	// Generate the istiod host the same way as istioctl.
	istioNS := ist.Settings().SystemNamespace
	istioRevision := getIstioRevision(cfg.Namespace)
	istioHost = istioctlcmd.IstiodHost(istioNS, istioRevision)

	istioIPAddr := ist.EastWestGatewayFor(cfg.Cluster).DiscoveryAddresses()[0].Addr()

		gvr.KubernetesGateway,
		gvr.GatewayClass,
		gvr.WorkloadEntry,
		gvr.ServiceEntry,
	} {
		clienttest.MakeCRD(t, cl, crd)
	}
	idx := New(Options{
		Client:          cl,
		SystemNamespace: systemNS,
		DomainSuffix:    "company.com",
		ClusterID:       clusterID,
		XDSUpdater:      up,
		LookupNetwork: func(endpointIP string, labels labels.Instance) network.ID {
			return networkID
		},