func (c Config) IsAllNaked() bool {
	if len(c.Subsets) == 0 {
		// No subsets - default to not-naked.
		return false
	}
	// if ANY subset has a sidecar, not naked.
	for _, s := range c.Subsets {
		if s.Annotations == nil || s.Annotations[annotation.SidecarInject.Name] != "false" {
			// Sidecar injection is enabled - it's not naked.
			return false
		}
	}
	// All subsets were annotated indicating no sidecar injection.

	// headless
	headless1 = &fakeInstance{Cluster: cls1, Namespace: namespace.Static("echo"), Service: "headless", Headless: true}
	// naked pod (uninjected)
	naked1 = &fakeInstance{Cluster: cls1, Namespace: namespace.Static("echo"), Service: "naked", Subsets: []echo.SubsetConfig{{
		Annotations: map[string]string{annotation.SidecarInject.Name: "false"},
	}}}
	// external svc
	external1 = &fakeInstance{

				return nil
			})

			// Check request and responses have no proxy headers
			instance.CallOrFail(t, echo.CallOptions{
				To: apps.Naked,
				Port: echo.Port{
					Name: ports.HTTP.Name,
				},
				Check: check.And(check.OK(), checkNoProxyHeaders),
			})
			apps.Naked[0].CallOrFail(t, echo.CallOptions{
				To: instance,
				Port: echo.Port{
					Name: ports.HTTP.Name,
				},

	CSvc             = "c"
	DSvc             = "d"
	ESvc             = "e"
	MultiversionSvc  = "multiversion"
	VMSvc            = "vm"
	HeadlessSvc      = "headless"
	NakedSvc         = "naked"
	HeadlessNakedSvc = "headless-naked"
	ExternalSvc      = "external"
)

type EchoDeployments struct {
	// TODO: Consolidate the echo config and reduce/reuse echo instances (https://github.com/istio/istio/issues/28599)

		// "destination_app":                "unknown",
		// "destination_version":            "unknown",
		"destination_service":            "naked." + ns.Name() + ".svc.cluster.local",
		"destination_service_name":       "naked",
		"destination_workload_namespace": ns.Name(),
		"destination_service_namespace":  ns.Name(),
		"source_app":                     "a",
		"source_version":                 "v1",

	framework.
		NewTest(t).
		Run(func(t framework.TestContext) {
			type expect struct {
				port echo.Port
				// Plaintext will be sent from Naked pods.
				plaintextSucceeds bool
				// MTLS will be sent from all pods other than Naked.
				mtlsSucceeds bool
			}
			cases := []struct {
				name     string
				config   string
				expected []expect
			}{
				// There is no authN/authZ policy.

    bool has_ref_vars, bool may_alias_resource_update) {
  XlaCompiler::CompileOptions compile_options;
  compile_options.is_entry_computation = true;
  // Optimization: where possible, have the computation return a naked array
  // rather than a one-element tuple.
  compile_options.always_return_tuple = false;
  compile_options.alias_resource_update =
      !has_ref_vars && may_alias_resource_update;
  return compile_options;
}

func TestLocality(t *testing.T) {
	// nolint: staticcheck
	framework.
		NewTest(t).
		RequiresSingleCluster().
		Run(func(t framework.TestContext) {
			destA := apps.B[0]
			destB := apps.C[0]
			destC := apps.Naked[0]
			if !t.Settings().Skip(echo.VM) {
				// TODO do we even need this to be a VM
				destC = apps.VM[0]
			}

			cases := []struct {
				name     string
				input    LocalityInput

		ServiceAccount:  true,
		Headless:        true,
		StatefulSet:     true,
		Ports:           ports.Headless(),
		Subsets:         []echo.SubsetConfig{{}},
		IncludeExtAuthz: c.IncludeExtAuthz,
	}

	naked := echo.Config{
		Service:        NakedSvc,
		ServiceAccount: true,
		Ports:          ports.All(),
		Subsets: []echo.SubsetConfig{
			{
				Annotations: map[string]string{annotation.SidecarInject.Name: "false"},

	testPos(t, decls, "package p; ", "",
		func(f *File) Node { return f.DeclList[0] },
	)

	// embed expressions in a composite literal so we can test key:value and naked composite literals
	testPos(t, exprs, "package p; var _ = T{ ", " }",
		func(f *File) Node { return f.DeclList[0].(*VarDecl).Values.(*CompositeLit).ElemList[0] },
	)