in real backend servers.

The fuzz test is configured to run every day at 07:00AM UTC, check the results in
[integ-security-fuzz-k8s-tests_istio_periodic](https://prow.istio.io/?job=integ-security-fuzz-k8s-tests_istio_periodic).

## Usage

1. Run the test with existing Istio deployment:

    ```bash

	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
	"k8s.io/utils/ptr"

	fuzz "github.com/google/gofuzz"
)

func TestValidateStructuralMetadataInvariants(t *testing.T) {
	fuzzer := fuzz.New()
	fuzzer.Funcs(
		func(s *JSON, c fuzz.Continue) {
			if c.RandBool() {
				s.Object = float64(42.0)
			}
		},
		func(s **StructuralOrBool, c fuzz.Continue) {
			if c.RandBool() {
				*s = &StructuralOrBool{}
			}
		},

func FuzzDeepCopyIstioEndpoint(f *testing.F) {
	fuzzDeepCopy[*IstioEndpoint](f)
}

type deepCopier[T any] interface {
	DeepCopy() T
}

func fuzzDeepCopy[T deepCopier[T]](f test.Fuzzer) {
	fuzz.Fuzz(f, func(fg fuzz.Helper) {
		orig := fuzz.Struct[T](fg)
		copied := orig.DeepCopy()
		assert.Equal(fg.T(), orig, copied)
	})

[!fuzz] skip
[short] skip
env GOCACHE=$WORK/cache

# This test checks that cached corpus loading properly handles duplicate entries (this can
# happen when a f.Add value has a duplicate entry in the cached corpus.) Duplicate entries
# should be discarded, and the rest of the cache should be loaded as normal.

env GOCACHE=$WORK/cache
env GODEBUG=fuzzdebug=1

mkdir -p $GOCACHE/fuzz/fuzztest/FuzzTarget
go run ./populate $GOCACHE/fuzz/fuzztest/FuzzTarget

	"istio.io/istio/pkg/config/host"
	"istio.io/istio/pkg/fuzz"
)

func FuzzApplyClusterMerge(f *testing.F) {
	f.Fuzz(func(t *testing.T, patchCount int, hostname string, data []byte) {
		defer fuzz.Finalize()
		fg := fuzz.New(t, data)
		patches := fuzz.Slice[*networking.EnvoyFilter_EnvoyConfigObjectPatch](fg, patchCount%30)
		proxy := fuzz.Struct[*model.Proxy](fg)
		mesh := fuzz.Struct[*meshconfig.MeshConfig](fg)

// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

package fuzz

import (
	fuzz "github.com/AdaLogics/go-fuzz-headers"

	"istio.io/api/meta/v1alpha1"
	"istio.io/istio/pilot/pkg/status/distribution"
)

// FuzzReconcileStatuses implements a fuzzer that targets

			c.FuzzNoCustom(s)
			if s.Schema != nil {
				s.Allows = false
			}
		},
		func(s **string, c fuzz.Continue) {
			c.FuzzNoCustom(s)
			if *s != nil && **s == "" {
				*s = nil
			}
		},
	)

	f.MaxDepth(2)
	f.NilChance(0.5)

	for i := 0; i < 10000; i++ {
		// fuzz a random field in JSONSchemaProps
		origSchema := &apiextensions.JSONSchemaProps{}

[!fuzz] skip
[!cgo] skip
[short] skip
env GOCACHE=$WORK/cache

# Test that fuzzing works with cgo (issue 65169)

go test -fuzz=. -fuzztime=1x
stdout ok
! stdout FAIL

-- go.mod --
module example.com/p

go 1.20
-- c.go --
package p

import "C"
-- c_test.go --
package p

import "testing"

func Fuzz(f *testing.F) {
	f.Add(0)
	f.Fuzz(func(t *testing.T, x int) {})

[!fuzz] skip

# Test basic fuzzing mutator behavior.
#
# fuzz_test.go has two fuzz targets (FuzzA, FuzzB) which both add a seed value.
# Each fuzz function writes the input to a log file. The coordinator and worker
# use separate log files. check_logs.go verifies that the coordinator only
# tests seed values and the worker tests mutated values on the fuzz target.

[short] skip
env GOCACHE=$WORK/cache

package loadbalancer

import (
	"testing"

	fuzz "github.com/AdaLogics/go-fuzz-headers"
	core "github.com/envoyproxy/go-control-plane/envoy/config/core/v3"
	endpoint "github.com/envoyproxy/go-control-plane/envoy/config/endpoint/v3"

	"istio.io/api/networking/v1alpha3"
)

func FuzzApplyLocalityLBSetting(f *testing.F) {
	f.Fuzz(func(t *testing.T, data []byte) {
		ff := fuzz.NewConsumer(data)
		proxyLabels := make(map[string]string)