continue
			}

			const M = 1<<16 - 1
			var dr, dg, db, da uint32
			if op == Over {
				dr, dg, db, da = dst.At(x, y).RGBA()
			}
			sr, sg, sb, sa := src.At(sx, sy).RGBA()
			ma := uint32(M)
			if mask != nil {
				_, _, _, ma = mask.At(mx, my).RGBA()
			}
			a := M - (sa * ma / M)
			golden.Set(x, y, color.RGBA64{
				uint16((dr*a + sr*ma) / M),
				uint16((dg*a + sg*ma) / M),

			}
			for i, dr := range drList {
				if dr.rule.Name != tt.expectedDrName[i] {
					t.Errorf("destinationRuleName expected %v got %v", tt.expectedDrName[i], dr.rule.Name)
				}
			}
			testLocal := ps.destinationRuleIndex.namespaceLocal[tt.proxyNs]
			if testLocal != nil {
				destRules := testLocal.specificDestRules
				for _, dr := range destRules[host.Name(testhost)] {

// Map of all configs that do not impact LDS
var skippedLdsConfigs = map[model.NodeType]sets.Set[kind.Kind]{
	model.Router: sets.New(
		// for autopassthrough gateways, we build filterchains per-dr subset
		kind.WorkloadGroup,
		kind.WorkloadEntry,
		kind.Secret,
		kind.ProxyConfig,
		kind.DNSName,
	),
	model.SidecarProxy: sets.New(
		kind.Gateway,
		kind.WorkloadGroup,
		kind.WorkloadEntry,

							param.Namespace.String(): apps.Ns1.Namespace,
						})).
						// It's not trivial to force mTLS to pass-through ports. To work around this, we will
						// set up a SE and DR that forces it.
						//
						// Since our client will talk directly to pods via IP, we have to configure the ports
						// in the SE as TCP, since only TCP does will match based in IP address rather than host.

  selector:
    app: echo
  ports:
  - name: grpc
    targetPort: grpc
    port: 7070
`,
		ConfigString: `
apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
  name: echo-dr
  namespace: default
spec:
  host: echo-app.default.svc.cluster.local
  subsets:
    - name: v1
      labels:
        version: v1
    - name: v2
      labels:
        version: v2
---

  ports:
  - number: 80
    name: http-port
    protocol: HTTP
    targetPort: 443
  - number: 443
    name: https-port
    protocol: HTTPS
  resolution: DNS
`
	dr := `
apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
  name: originate-tls-for-server-sds-{{.WorkloadSelector}}
spec:
  workloadSelector:
    matchLabels:

            return;
        } catch( DfsReferral dr ) {
            StringBuffer redir = req.getRequestURL();
            String qs = req.getQueryString();
            redir = new StringBuffer( redir.substring( 0, redir.length() - req.getPathInfo().length() ));
            redir.append( '/' );
            redir.append(dr.server);
            redir.append( '/' );
            redir.append(dr.share);
            redir.append( '/' );

	}
}

// Set auto_sni if EnableAutoSni feature flag is enabled and if sni field is not explicitly set in DR.
// Set auto_san_validation if VerifyCertAtClient feature flag is enabled and if there is no explicit SubjectAltNames specified  in DR.
func (cb *ClusterBuilder) setAutoSniAndAutoSanValidation(mc *clusterWrapper, tls *networking.ClientTLSSettings) {
	if mc == nil || !features.EnableAutoSni {

		}
	}
}

func TestXdsCache(t *testing.T) {
	makeEp := func(subset string, dr *model.ConsolidatedDestRule) *endpoints.EndpointBuilder {
		svc := &model.Service{Hostname: "foo.com"}
		b := endpoints.NewCDSEndpointBuilder(
			proxy, nil,
			fmt.Sprintf("outbound|%s|foo.com", subset),
			model.TrafficDirectionOutbound, subset, "foo.com", 80,
			svc, dr)
		return b
	}
	ep1 := makeEp("1", nil)
	ep2 := makeEp("2", nil)

		}
	}

	resourceDebugInfo := map[string]string{}
	dr, dnr := deploymentsReady(cs, deployments, resourceDebugInfo)
	dsr, dsnr := daemonsetsReady(daemonsets)
	stsr, stsnr := statefulsetsReady(statefulsets)
	nsr, nnr := namespacesReady(namespaces)
	pr, pnr := podsReady(pods)
	isReady := dr && nsr && dsr && stsr && pr
	notReady := append(append(append(append(nnr, dnr...), pnr...), dsnr...), stsnr...)