s := newAmbientTestServer(t, testC, testNW)

	s.addServiceEntry(t, "se.istio.io", []string{"240.240.23.45"}, "se1", testNS, map[string]string{"app": "a"}, []string{"127.0.0.1", "127.0.0.2"})
	s.assertWorkloads(t, "", workloadapi.WorkloadStatus_HEALTHY, "se1")
	s.assertEvent(t, s.seIPXdsName("se1", "127.0.0.1"), s.seIPXdsName("se1", "127.0.0.2"), "ns1/se.istio.io")

      app: foo
  mtls:
    mode: DISABLE
  portLevelMtls:
    9000:
      mode: PERMISSIVE
---`
	sePort8000 := `
apiVersion: networking.istio.io/v1alpha3
kind: ServiceEntry
metadata:
 name: se
spec:
 hosts:
 - foo.bar
 endpoints:
 - address: 1.1.1.1
 location: MESH_INTERNAL
 resolution: STATIC
 ports:
 - name: http
   number: 8000
   protocol: HTTP
---`

		portNumber, _, _ := ParseGatewayRDSRouteName(r)
		if _, f := pm[portNumber]; !f {
			pm[portNumber] = sets.New[int]()
		}
		for _, se := range s {
			if se.Port == nil {
				continue
			}
			pm[portNumber].Insert(int(se.Port.Number))
		}
	}
	return pm

) {
	args := map[string]any{
		"to":               to,
		"Mode":             destinationRuleMode,
		"CredentialName":   credentialName,
		"WorkloadSelector": workloadSelector,
	}
	se := `
apiVersion: networking.istio.io/v1alpha3
kind: ServiceEntry
metadata:
  name: originate-mtls-for-nginx
spec:
  hosts:
  - "{{ .to.Config.ClusterLocalFQDN }}"
  ports:
  - number: 80

	// Add the ServiceExport info.
	for _, se := range c.exports.ExportedServices() {
		mcsService := outMap[se.namespacedName]
		mcsService.Cluster = c.Cluster()
		mcsService.Name = se.namespacedName.Name
		mcsService.Namespace = se.namespacedName.Namespace
		mcsService.Exported = true
		mcsService.Discoverability = se.discoverability
		outMap[se.namespacedName] = mcsService
	}

			t.ConfigIstio().File(apps.Namespace.Name(), filepath.Join(base, "istio-mtls-gateway.yaml")).ApplyOrFail(t)
			t.ConfigIstio().File(apps.Namespace.Name(), filepath.Join(base, "istio-mtls-vs.yaml")).ApplyOrFail(t)

			// The main SE is available only to app namespace, make one the egress can access.
			t.ConfigIstio().Eval(ist.Settings().SystemNamespace, map[string]any{
				"Namespace": apps.External.Namespace.Name(),

	s := xdsfake.NewFakeDiscoveryServer(t, xdsfake.FakeOptions{
		ConfigString: mustReadFile(t, "tests/testdata/config/destination-rule-all.yaml") +
			mustReadFile(t, "tests/testdata/config/static-weighted-se.yaml"),
	})
	ads := s.Connect(nil, nil, watchAll)
	t.Run("Full Push", func(t *testing.T) {
		s.Discovery.Push(&model.PushRequest{Full: true})
		if _, err := ads.Wait(time.Second*5, watchAll...); err != nil {
			t.Fatal(err)

MTIyMDEyMzRaFw0zMDA4MTAyMDEyMzRaMFQxCzAJBgNVBAYTAlVTMQ8wDQYDVQQI
DAZEZW5pYWwxDjAMBgNVBAcMBUV0aGVyMQwwCgYDVQQKDANEaXMxFjAUBgNVBAMM
DSouZXhhbXBsZS5jb20wggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQDC
se+/CHI6gNhoj2pW/iawYaZT+FavNBwKq9y8+jQKp8ZSQvF0+44KWWTu258I/xxK
agJpXITOieCuLOHxsw2iMCgHz8US3cuAm3trvVG5se4ksEzBKXEqUtr4x7j25zUr
6r3JNQ1S51zIthc85ZchZFkS82T7uEgpYF5mDEbP7jlfZ/KVL/oquH1IJOjCufIU

			Equals(true, "{.useOriginalDst}").
			CheckOrFail(t)
	})

	t.Run("mongo", func(t *testing.T) {
		s := xds.NewFakeDiscoveryServer(t, xds.FakeOptions{
			ConfigString: mustReadFile(t, "tests/testdata/config/se-example.yaml"),
		})
		proxy := s.SetupProxy(&model.Proxy{
			IPAddresses: []string{"10.2.0.1"},
			ID:          "app3.testns",
		})
		structpath.ForProto(xdstest.ToDiscoveryResponse(s.Listeners(proxy))).

					}
					configObjects := `
---
apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
  name: subset-se
  namespace: test
spec:
  host: "*"
  subsets:
  - name: v1
    labels:
      version: v1
  - name: v2
    labels:
      version: v2
  - name: v3
    labels:
      version: v3
`