{{- $subsets := .Subsets }}
{{- $cluster := .Cluster }}
{{- range $i, $subset := $subsets }}
apiVersion: apps/v1
kind: Deployment
metadata:
  name: {{ $.Service }}-{{ $subset.Version }}
spec:
  replicas: 1
  selector:
    matchLabels:
      istio.io/test-vm: {{ $.Service }}
      istio.io/test-vm-version: {{ $subset.Version }}
  template:
    metadata:
      annotations:

	// TODO make these check if any subset has a matching annotation
	return len(c.Subsets) > 0 && c.Subsets[0].Annotations != nil && strings.HasPrefix(c.Subsets[0].Annotations[annotation.InjectTemplates.Name], "grpc-")
}

func (c Config) IsTProxy() bool {
	// TODO this could be HasCustomInjectionMode

func tlsModeForDestinationRule(drc *config.Config, subset string, port int) *networkingapi.ClientTLSSettings_TLSmode {
	if drc == nil {
		return nil
	}
	dr, ok := drc.Spec.(*networkingapi.DestinationRule)
	if !ok || dr == nil {
		return nil
	}

	if subset == "" {
		return trafficPolicyTLSModeForPort(dr.GetTrafficPolicy(), port)
	}

	for _, ss := range dr.Subsets {
		if ss.Name != subset {
			continue
		}

}

// getDestRuleSubsets gets names of subsets that match any pod labels (also, ones that don't match).
func getDestRuleSubsets(subsets []*v1alpha3.Subset, podsLabels []klabels.Set) ([]string, []string) {
	matchingSubsets := make([]string, 0, len(subsets))
	nonmatchingSubsets := make([]string, 0, len(subsets))
	for _, subset := range subsets {
		subsetSelector := klabels.SelectorFromSet(subset.Labels)

					}
					for _, subset := range tt.destRule.Subsets {
						if subset.Name == subsetName {
							if subset.GetTrafficPolicy().GetTls() != nil {
								verifyALPNOverride(t, c.Metadata, subset.TrafficPolicy.Tls.Mode)
							}
						}
					}
				}
			}

			// Validate that ORIGINAL_DST cluster does not have load assignments
			for _, subset := range subsetClusters {

			args: strings.Split("service productpage", " "),
			expectedOutput: `Service: productpage
DestinationRule: productpage for "productpage"
   WARNING POD DOES NOT MATCH ANY SUBSETS.  (Non matching subsets v1)
   Matching subsets: 
      (Non-matching subsets v1)
   No Traffic Policy
VirtualService: bookinfo
   Route to host "productpage" with weight 30%
   Route to host "productpage2" with weight 20%

	}{
		{
			name: "tunneling_config should not be applied when destination rule and listener subsets do not match",
			routeDestinations: []*networking.RouteDestination{
				{
					Destination: &networking.Destination{
						Host:   "tunnel-proxy.com",
						Port:   &networking.PortSelector{Number: 3128},
						Subset: "random-subset",
					},
				},
			},
			destinationRule:         tunnelingEnabledForSubset,

// - VM
// - Naked
// - Headless
// - TProxy
// - Multi-Subset
var RegularPod Matcher = func(instance echo.Instance) bool {
	return instance.Config().IsRegularPod()
}

var NotRegularPod = Not(RegularPod)

// MultiVersion matches echos that have Multi-version specific setup.
var MultiVersion Matcher = func(i echo.Instance) bool {
	if len(i.Config().Subsets) != 2 {
		return false
	}
	var matchIstio, matchLegacy bool

	// empty subset
	if subsetName == "" {
		return nil
	}

	if dr == nil {
		return nil
	}

	for _, subset := range dr.Subsets {
		if subset.Name == subsetName {
			if len(subset.Labels) == 0 {
				return nil
			}
			return subset.Labels
		}
	}

	return nil

			"ContainerPorts": grpcPorts,
			"FallbackPort":   grpcFallbackPort,
		})
	}

	if cfg.WorkloadWaypointProxy != "" {
		for _, subset := range cfg.Subsets {
			if subset.Labels == nil {
				subset.Labels = make(map[string]string)
			}
			subset.Labels[constants.AmbientUseWaypointLabel] = cfg.WorkloadWaypointProxy
		}
	}

	params := map[string]any{
		"ImageHub":                settings.Image.Hub,