// 2) or if we have an empty destination VIP (i.e. which we should never get in case some platform adapter improper handlings);
		// 3) or if the destination is a wildcard destination VIP with the listener bound to the wildcard as well.
		// In the above cited cases, the listener will be bound to 0.0.0.0. So SNI match is the only way to distinguish different

// resources (with delta updates), or on-demand and only get responses for specifically subscribed resources.
//
// Incoming requests may be for VIP or Pod IP addresses. However, all responses are Workload resources, which are pod based.
// This means subscribing to a VIP may end up pushing many resources of different name than the request.

}

// AddHTTPService is a helper to add a service of type http, named 'http-main', with the
// specified vip and port.
func (sd *ServiceDiscovery) AddHTTPService(name, vip string, port int) {
	sd.AddService(&model.Service{
		Hostname:       host.Name(name),
		DefaultAddress: vip,
		Ports: model.PortList{
			{
				Name:     "http-main",
				Port:     port,
				Protocol: protocol.HTTP,
			},
		},

	tests := []struct {
		network   string
		sidecarID string
		want      expectedResults
	}{
		{
			// Verify that EDS from network1 will return 1 local endpoint with local VIP + 2 remote
			// endpoints weighted accordingly with the IP of the ingress gateway.
			network:   "network1",
			sidecarID: sidecarID("10.1.0.1", "app3"),
			want: expectedResults{
				weights: map[string]uint32{

			return r
		}
		if r := cmp.Compare(a.Name, b.Name); r != 0 {
			return r
		}
		return cmp.Compare(a.Hostname, b.Hostname)
	})
	fmt.Fprintln(w, "NAMESPACE\tSERVICE NAME\tSERVICE VIP\tWAYPOINT")

	for _, svc := range svcs {
		var ip string
		if len(svc.Addresses) > 0 {
			_, ip, _ = strings.Cut(svc.Addresses[0], "/")
		}
		waypoint := serviceWaypointName(svc, zDump.Services)

package model

import (
	"testing"

	"istio.io/istio/pkg/config/labels"
	"istio.io/istio/pkg/config/protocol"
)

var service1 = &Service{
	Hostname:       "one.service.com",
	DefaultAddress: "192.168.3.1", // VIP
	Ports: PortList{
		&Port{Name: "http", Port: 81, Protocol: protocol.HTTP},
		&Port{Name: "http-alt", Port: 8081, Protocol: protocol.HTTP},
	},
}

func TestServiceInstanceValidate(t *testing.T) {

	for _, s := range d.Services {
		var ip string
		if len(s.Addresses) != 0 {
			_, ip, _ = strings.Cut(s.Addresses[0], "/")
		}
		if ip == "" {
			// fallback to None when a service does not have a VIP
			ip = "None"
		}
		serviceNames[ip] = s.Hostname
	}
	for _, s := range d.Workloads {
		var ip string
		if len(s.WorkloadIPs) != 0 {
			ip = s.WorkloadIPs[0]
		}
		if ip == "" {

// ServiceExport to control the discoverability policy for individual endpoints, this controller
// reads ServiceImport in the cluster in order to extract the ClusterSet VIP and generate a
// synthetic service for the MCS host (i.e. clusterset.local). The aggregate.Controller will then
// merge together the MCS services from all the clusters, filling out the full map of Cluster IPs.
//

	Port     uint32
	Protocol workloadapi.ApplicationTunnel_Protocol
}

type Waypoint struct {
	krt.Named

	// Addresses this Waypoint is reachable by. For stock Istio waypoints, this
	// is is usually the VIP. Tere will always be at least one address in this
	// list.
	Addresses []netip.Addr

	// DefaultBinding for an inbound zTunnel to use to connect to a Waypoint it captures.

			// The kube dummy interface has all service VIPs assigned which
			// results in the service VIP being picked as the source IP to reach
			// a VIP. This leads to a connection from VIP:<random port> to
			// VIP:<service port>.
			// Always masquerading OUTPUT (node-originating) traffic with a VIP
			// source ip and service port destination fixes the outgoing connections.
			proxier.natRules.Write(