template := &x509.CertificateRequest{
		Subject: pkix.Name{
			CommonName:   cfg.CommonName,
			Organization: cfg.Organization,
		},
		DNSNames:    cfg.AltNames.DNSNames,
		IPAddresses: cfg.AltNames.IPs,
	}

	csrBytes, err := x509.CreateCertificateRequest(cryptorand.Reader, template, key)

	if err != nil {
		return nil, errors.Wrap(err, "failed to create a CSR")
	}

            {
              "resource": "ipaddresses",
              "responseKind": {
                "group": "",
                "kind": "IPAddress",
                "version": ""
              },
              "scope": "Cluster",
              "shortNames": [
                "ip"
              ],
              "singularResource": "ipaddress",
              "verbs": [
                "create",

            {
              "resource": "ipaddresses",
              "responseKind": {
                "group": "",
                "kind": "IPAddress",
                "version": ""
              },
              "scope": "Cluster",
              "shortNames": [
                "ip"
              ],
              "singularResource": "ipaddress",
              "verbs": [
                "create",

	}, serviceImportTimeout)
}

func (ic *serviceImportCacheImpl) getProxyServiceTargets() []model.ServiceTarget {
	return ic.GetProxyServiceTargets(&model.Proxy{
		Type:            model.SidecarProxy,
		IPAddresses:     []string{serviceImportPodIP},
		Locality:        &core.Locality{Region: "r", Zone: "z"},
		ConfigNamespace: serviceImportNamespace,
		Labels: map[string]string{
			"app":                      "prod-app",

func certToConfig(cert *x509.Certificate) certutil.Config {
	return certutil.Config{
		CommonName:   cert.Subject.CommonName,
		Organization: cert.Subject.Organization,
		AltNames: certutil.AltNames{
			IPs:      cert.IPAddresses,
			DNSNames: cert.DNSNames,
		},
		Usages: cert.ExtKeyUsage,
	}
}

func loadCertConfigMutators(certBaseName string) []certConfigMutatorFunc {
	return nil

			return f.BufListener.Dial()
		}))
	}
	adscConn, err := adsc.New(f.Listener.Addr().String(), &adsc.ADSConfig{
		Config: adsc.Config{
			IP:        p.IPAddresses[0],
			NodeType:  p.Type,
			Meta:      p.Metadata.ToStruct(),
			Locality:  p.Locality,
			Namespace: p.ConfigNamespace,
			GrpcOpts:  opts,
		},
		InitialDiscoveryRequests: initialWatch,
	})

func (s *Controller) GetProxyServiceTargets(node *model.Proxy) []model.ServiceTarget {
	out := make([]model.ServiceTarget, 0)
	s.mutex.RLock()
	defer s.mutex.RUnlock()
	for _, ip := range node.IPAddresses {
		instances := s.serviceInstances.getByIP(ip)
		for _, i := range instances {
			// Insert all instances for this IP for services within the same namespace. This ensures we

			if !f {
				log.Warnf("unexpected state, svc %v missing port %v", svc.Hostname, instance.ServicePortName)
				continue
			}
			// consider multiple IP scenarios
			for _, ip := range proxy.IPAddresses {
				if ip != instance.Address {
					continue
				}
				// If the endpoint isn't ready, report this
				if instance.HealthStatus == model.UnHealthy && esc.c.opts.Metrics != nil {

	case model.SidecarProxy:
		proxy = &model.Proxy{
			Type:         model.SidecarProxy,
			IPAddresses:  c.proxyIps,
			Locality:     c.locality,
			DNSDomain:    "com",
			Metadata:     c.meta,
			IstioVersion: c.istioVersion,
		}
	case model.Router:
		proxy = &model.Proxy{
			Type:         model.Router,
			IPAddresses:  []string{"6.6.6.6"},
			Locality:     c.locality,
			DNSDomain:    "default.example.org",

		if err := cert.VerifyHostname(dnsName); err != nil {
			return errors.Wrapf(err, "certificate %s is invalid", baseName)
		}
	}
	for _, ipAddress := range cfg.AltNames.IPs {
		if err := cert.VerifyHostname(ipAddress.String()); err != nil {
			return errors.Wrapf(err, "certificate %s is invalid", baseName)
		}
	}
	return nil
}