type mtlsChecker struct {
	push            *model.PushContext
	svcPort         int
	destinationRule *networkingapi.ClientTLSSettings_TLSmode
}

func newMtlsChecker(push *model.PushContext, svcPort int, dr *config.Config, subset string) *mtlsChecker {
	return &mtlsChecker{
		push:            push,
		svcPort:         svcPort,
		destinationRule: tlsModeForDestinationRule(dr, subset, svcPort),
	}
}

# Fails if a service with the name exists: trusted_ca required !
apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
  name: ssl-simple
  namespace: testns
spec:
  host: ssl1.webinf.info
  trafficPolicy:
    loadBalancer:
      simple: LEAST_CONN
    tls:
      mode: SIMPLE
---
# This will not work: myCA not found, results in rejecting all clusters if the
# service exists.
apiVersion: networking.istio.io/v1alpha3

					},
				},
				{
					Meta: config.Meta{
						GroupVersionKind: gvk.DestinationRule,
						Name:             "mtls-on",
						Namespace:        "ns",
					},
					Spec: &networking.DestinationRule{
						Host: "example.ns.svc.cluster.local",
						TrafficPolicy: &networking.TrafficPolicy{

apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
  name: tunnel-outbound-traffic-to-external-svc-via-external-forward-proxy
spec:
  host: external-forward-proxy.{{ .externalNamespace }}.svc.cluster.local
  subsets:
  - name: external-svc-tcp
    trafficPolicy:
      tunnel:
        targetHost: external.{{ .externalNamespace }}
        targetPort: {{ .externalSvcTcpPort }}
  - name: external-svc-tls
    trafficPolicy:

func (ps *PushContext) mergeDestinationRule(p *consolidatedDestRules, destRuleConfig config.Config, exportToSet sets.Set[visibility.Instance]) {
	rule := destRuleConfig.Spec.(*networking.DestinationRule)
	resolvedHost := host.Name(rule.Host)

	var destRules map[host.Name][]*ConsolidatedDestRule

	if resolvedHost.IsWildCarded() {
		destRules = p.wildcardDestRules
	} else {
		destRules = p.specificDestRules

		return gvk.DaemonSet, true
	case *k8sioapiappsv1.Deployment:
		return gvk.Deployment, true
	case *istioioapinetworkingv1alpha3.DestinationRule:
		return gvk.DestinationRule, true
	case *apiistioioapinetworkingv1alpha3.DestinationRule:
		return gvk.DestinationRule, true
	case *k8sioapidiscoveryv1.EndpointSlice:
		return gvk.EndpointSlice, true
	case *k8sioapicorev1.Endpoints:
		return gvk.Endpoints, true

	}.MustBuild()

	DestinationRule = resource.Builder{
		Identifier: "DestinationRule",
		Group:      "networking.istio.io",
		Kind:       "DestinationRule",
		Plural:     "destinationrules",
		Version:    "v1alpha3",
		VersionAliases: []string{
			"v1beta1",
			"v1",
		},
		Proto: "istio.networking.v1alpha3.DestinationRule", StatusProto: "istio.meta.v1alpha1.IstioStatus",

		clusterMode            ClusterMode
		service                *model.Service
		port                   *model.Port
		proxyView              model.ProxyView
		destRule               *networking.DestinationRule
		meshConfig             *meshconfig.MeshConfig
		expectedSubsetClusters []*cluster.Cluster
	}{
		// TODO(ramaraochavali): Add more tests to cover additional conditions.
		{

# Attempt to use all possible fields in DestinationRule
apiVersion: networking.istio.io/v1alpha3
kind: ServiceEntry
metadata:
  name: destall
  namespace: testns
spec:
   hosts:
   - destall.default.svc.cluster.local
   ports:
   - number: 81
     name: http
     protocol: HTTP
   resolution: STATIC
   endpoints:
    - address: 127.0.0.2
      ports:
        http: 7072
---
apiVersion: networking.istio.io/v1alpha3

		},
		{
			// Set DestinationRule override for tcp_keepalive.
			"destination rule",
			DestinationRule,
			&core.TcpKeepalive{KeepaliveTime: &wrappers.UInt32Value{Value: uint32(DestinationRuleTCPKeepaliveSeconds)}},
		},
		{
			// Set DestinationRule override for tcp_keepalive with empty value.
			"destination rule default",
			DestinationRuleForOsDefault,