}

	tmpl := &x509.Certificate{
		SerialNumber:       serialNumber,
		Subject:            cr.Subject,
		DNSNames:           cr.DNSNames,
		IPAddresses:        cr.IPAddresses,
		EmailAddresses:     cr.EmailAddresses,
		URIs:               cr.URIs,
		PublicKeyAlgorithm: cr.PublicKeyAlgorithm,
		PublicKey:          cr.PublicKey,
		Extensions:         cr.Extensions,

{
  "apiVersion": "v1",
  "groupVersion": "networking.k8s.io/v1alpha1",
  "kind": "APIResourceList",
  "resources": [
    {
      "kind": "IPAddress",
      "name": "ipaddresses",
      "namespaced": false,
      "shortNames": [
        "ip"
      ],
      "singularName": "ipaddress",
      "storageVersionHash": "3APLM23DOxw=",
      "verbs": [
        "create",
        "delete",
        "deletecollection",
        "get",

// the expected IPAddresses
func AssertCertificateHasIPAddresses(t *testing.T, cert *x509.Certificate, IPAddresses ...net.IP) {
	for _, IPAddress := range IPAddresses {
		found := false
		for _, val := range cert.IPAddresses {
			if val.Equal(IPAddress) {
				found = true
				break
			}
		}

		if !found {
			t.Errorf("cert does not contain IPAddress %s", IPAddress)
		}
	}
}

	}

	tmpl := &x509.Certificate{
		SerialNumber:       serialNumber,
		Subject:            cr.Subject,
		DNSNames:           cr.DNSNames,
		IPAddresses:        cr.IPAddresses,
		EmailAddresses:     cr.EmailAddresses,
		URIs:               cr.URIs,
		PublicKeyAlgorithm: cr.PublicKeyAlgorithm,
		PublicKey:          cr.PublicKey,
		Extensions:         cr.Extensions,

	t.Run("sidecar_none", func(t *testing.T) {
		wd := t.TempDir()
		adscon := s.Connect(&model.Proxy{
			Metadata: &model.NodeMetadata{
				InterceptionMode: model.InterceptionNone,
				HTTP10:           "1",
			},
			IPAddresses:     []string{"10.11.0.1"}, // matches none.yaml s1tcp.none
			ConfigNamespace: "none",
		}, nil, watchAll)

		err := adscon.Save(wd + "/none")
		if err != nil {
			t.Fatal(err)
		}

			h.HttpGet.Scheme = string(apimirror.URISchemeHTTP)
		}
		h.HttpGet.Scheme = strings.ToLower(h.HttpGet.Scheme)
		if h.HttpGet.Host == "" {
			if len(ipAddresses) == 0 || status.LegacyLocalhostProbeDestination.Get() {
				h.HttpGet.Host = "localhost"
			} else {
				h.HttpGet.Host = ipAddresses[0]
			}
		}
	}
	return cfg
}

			ClusterID: c.Cluster(),
		},
		tlsMode:  model.GetTLSModeFromEndpointLabels(proxy.Labels),
		nodeName: proxy.GetNodeName(),
	}
	var networkID network.ID
	if len(proxy.IPAddresses) > 0 {
		networkID = out.endpointNetwork(proxy.IPAddresses[0])
	}
	out.labels = labelutil.AugmentLabels(proxy.Labels, c.Cluster(), locality, out.nodeName, networkID)
	return out
}

func (b *EndpointBuilder) buildIstioEndpoint(

		NewListFunc:               func() runtime.Object { return &networking.IPAddressList{} },
		DefaultQualifiedResource:  networking.Resource("ipaddresses"),
		SingularQualifiedResource: networking.Resource("ipaddress"),

		CreateStrategy: ipaddress.Strategy,
		UpdateStrategy: ipaddress.Strategy,
		DeleteStrategy: ipaddress.Strategy,

func TestServiceScoping(t *testing.T) {
	baseProxy := func() *model.Proxy {
		return &model.Proxy{
			Metadata:        &model.NodeMetadata{},
			ID:              "app.app",
			Type:            model.SidecarProxy,
			IPAddresses:     []string{"1.1.1.1"},
			ConfigNamespace: "app",
		}
	}

	t.Run("STATIC", func(t *testing.T) {
		s := xds.NewFakeDiscoveryServer(t, xds.FakeOptions{
			ConfigString: scopeConfig,

		"missing group":      {IPAddresses: []string{"1.2.3.4"}, Metadata: &model.NodeMetadata{Namespace: wgA.Namespace}},
		"missing ip":         {Metadata: &model.NodeMetadata{Namespace: wgA.Namespace, AutoRegisterGroup: wgA.Name}},
		"missing namespace":  {IPAddresses: []string{"1.2.3.4"}, Metadata: &model.NodeMetadata{AutoRegisterGroup: wgA.Name}},