}

type testRequestSpec struct {
	protocol protocol.Instance
	port     echo.Port
}

var forwardProxyConfigurations = []forwardproxy.ListenerSettings{
	{
		Port:        3128,
		HTTPVersion: forwardproxy.HTTP1,
		TLSEnabled:  false,
	},
	{
		Port:        4128,
		HTTPVersion: forwardproxy.HTTP1,
		TLSEnabled:  true,
	},
	{
		Port:        5128,
		HTTPVersion: forwardproxy.HTTP2,
		TLSEnabled:  false,

		pl := &workloadapi.PortList{
			Ports: make([]*workloadapi.Port, 0, len(svc.Ports)),
		}
		res[n] = pl
		for _, port := range svc.Ports {
			targetPort := port.TargetPort
			// The svc.Ports represents the workloadapi.Service, which drops the port name info and just has numeric target Port.
			// TargetPort can be 0 which indicates its a named port. Check if its a named port and replace with the real targetPort if so.

	networkFilterStack := buildNetworkFiltersStack(port.Protocol, tcpFilter, statPrefix, clusterName)

	return lb.buildCompleteNetworkFilters(class, port.Port, networkFilterStack, includeMx, nil)
}

func (lb *ListenerBuilder) buildCompleteNetworkFilters(
	class istionetworking.ListenerClass,
	port int,
	networkFilterStack []*listener.Filter,
	includeMx bool,
	policySvc *model.Service,

func TestRunHandlerHTTPPort(t *testing.T) {
	tests := []struct {
		Name        string
		Port        intstr.IntOrString
		ExpectError bool
		Expected    string
	}{
		{
			Name:     "consistent/with port",
			Port:     intstr.FromString("70"),
			Expected: "https://foo:70/bar",
		}, {
			Name:        "consistent/without port",
			Port:        intstr.FromString(""),
			ExpectError: true,
		},
	}

			probe: `{"/app-health/hello-world/readyz": {"grpc": {"port": 8888}, "httpGet": {"path": "/", "port": 7777}}}`,
			err:   "must be one of type httpGet, tcpSocket or gRPC",
		},
		// Port is not Int typed (tcpSocket).
		{
			probe: `{"/app-health/hello-world/readyz": {"tcpSocket": {"port": "tcp"}}}`,
			err:   "must be int type",
		},
		// Port is not Int typed (httpGet).
		{

	}
	return model.ServiceTarget{
		Service: svc,
		Port: model.ServiceInstancePort{
			ServicePort: &model.Port{
				Name:     svcPort.Name,
				Port:     int(svcPort.Number),
				Protocol: protocol.Parse(svcPort.Protocol),
			},
			TargetPort: uint32(port),
		},
	}
}

// nolint: unparam
func makeInstance(cfg *config.Config, address string, port int,

						NotDestinationPorts: []uint32{port}, // if the incoming connection does not match this port, deny (notice there's no principals requirement)
					},
				},
			})
		default:
			log.Debugf("skipping port %s for PeerAuthentication %s/%s for ambient since it is %s", port, cfg.Namespace, cfg.Name, portMtlsMode)
			continue
		}
	}

					fldPath.Child("ports").Index(i), port))
			}
			k := fmt.Sprintf("%d/%s", port.ContainerPort, port.Protocol)
			if others, found := allPorts[k]; found {
				// Someone else has this protcol+port, but it still might not be a conflict.
				for _, other := range others {
					if port.HostIP == other.port.HostIP && port.HostPort == other.port.HostPort {

		// For service instances with the same port,
		// we still need to capture all the instances on this port, as its required to populate telemetry metadata
		// The first instance will be used as the "primary" instance; this means if we have an conflicts between
		// Services the first one wins
		port := int(instance.Port.TargetPort)
		clustersToBuild[port] = append(clustersToBuild[port], instance)
	}

	bind := actualLocalHosts[0]

	if config == nil {
		return fmt.Errorf("nil EnvoyExternalAuthorizationGrpcProvider")
	}
	if err := ValidatePort(int(config.Port)); err != nil {
		errs = AppendErrors(errs, fmt.Errorf("invalid service port: %v", err))
	}
	if err := validateExtensionProviderService(config.Service); err != nil {
		errs = AppendErrors(errs, err)
	}