ResourceApiVersion: core.ApiVersion_V3,
}

// ConstructSdsSecretConfigForCredential constructs SDS secret configuration used
// from certificates referenced by credentialName in DestinationRule or Gateway.
// Currently this is served by a local SDS server, but in the future replaced by
// Istiod SDS server.
func ConstructSdsSecretConfigForCredential(name string, credentialSocketExist bool) *tls.SdsSecretConfig {

	"istio.io/istio/pkg/test/framework/resource/config/apply"
	"istio.io/istio/tests/integration/security/util/cert"
)

const (
	DestinationRuleConfigIstioMutual = `
apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
  name: server
  namespace: {{.AppNamespace}}
spec:
  host: "server.{{.AppNamespace}}.svc.cluster.local"
  trafficPolicy:
    tls:
      mode: ISTIO_MUTUAL
`

				},
			}

			client[0].CallOrFail(t, opts)
		})
}

const (
	DestinationRuleConfigMutual = `
apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
  name: server
  namespace: {{.AppNamespace}}
spec:
  host: "server.{{.AppNamespace}}.svc.cluster.local"
  trafficPolicy:
    tls:
      mode: MUTUAL

      * `VirtualServices` that route to an `ExternalName` service will no longer work unless the referenced service exists (as a Service or ServiceEntry).
      * `DestinationRule` can no longer apply to `ExternalName` services. Instead, create rules where the `host` references service.

      To opt-out, the `ENABLE_EXTERNAL_NAME_ALIAS=false` environment variable can be set.

	// Description: No caCertificates are set in DestinationRule, this results in no verification of presented server certificate.
	NoServerCertificateVerificationDestinationLevel = diag.NewMessageType(diag.Warning, "IST0128", "DestinationRule %s in namespace %s has TLS mode set to %s but no caCertificates are set to validate server identity for host: %s")

## Configure weight-based routing

Declare the helloworld versions (Gateway API requires backend service definitions, unlike the Istio API which uses DestinationRule subsets for this):

```bash
kubectl apply -f ./helloworld-versions.yaml
```

Apply the following route rule to distribute the helloworld traffic 90% to v1, 10% to v2:

```bash

			model.ConfigKey{Kind: kind.DestinationRule, Name: drName, Namespace: nsName},
			model.ConfigKey{Kind: kind.ServiceEntry, Name: svcName + invalidNameSuffix, Namespace: nsName},
		), true},
		{"mixture unmatched and unmatched config for sidecar", sidecar, sets.New(
			model.ConfigKey{Kind: kind.DestinationRule, Name: drName + invalidNameSuffix, Namespace: nsName},

}

var _ model.XdsResourceGenerator = &NdsGenerator{}

// Map of all configs that do not impact NDS
var skippedNdsConfigs = sets.New(
	kind.Gateway,
	kind.VirtualService,
	kind.DestinationRule,
	kind.Secret,
	kind.Telemetry,
	kind.EnvoyFilter,
	kind.WorkloadEntry,
	kind.WorkloadGroup,
	kind.AuthorizationPolicy,
	kind.RequestAuthentication,
	kind.PeerAuthentication,
	kind.WasmPlugin,

	}{
		{name: "simple destination rule", in: &networking.DestinationRule{
			Host: "reviews",
			Subsets: []*networking.Subset{
				{Name: "v1", Labels: map[string]string{"version": "v1"}},
				{Name: "v2", Labels: map[string]string{"version": "v2"}},
			},
		}, valid: true},

		{name: "simple destination rule with empty selector labels", in: &networking.DestinationRule{
			Host: "reviews",
			Subsets: []*networking.Subset{

		name       string
		configName string
		schema     resource.Schema
		spec       config2.Spec
	}{
		{"VirtualService", configName, collections.VirtualService, ExampleVirtualService},
		{"DestinationRule", configName, collections.DestinationRule, ExampleDestinationRule},
		{"ServiceEntry", configName, collections.ServiceEntry, ExampleServiceEntry},
		{"Gateway", configName, collections.Gateway, ExampleGateway},