}

func maybeSetHashPolicy(destinationRule *networking.DestinationRule, tcpProxy *tcp.TcpProxy, subsetName string) {
	if destinationRule != nil {
		useSourceIP := destinationRule.GetTrafficPolicy().GetLoadBalancer().GetConsistentHash().GetUseSourceIp()
		for _, subset := range destinationRule.Subsets {
			if subset.Name != subsetName {
				continue
			}

			dr: &config.Config{
				Spec: &networking.DestinationRule{
					TrafficPolicy: &networking.TrafficPolicy{
						OutlierDetection: &networking.OutlierDetection{
							ConsecutiveErrors: 5,
						},
					},
				},
			},
			expectedLabels: nil,
		},
		{
			name: "failover priority disabled",
			dr: &config.Config{
				Spec: &networking.DestinationRule{
					TrafficPolicy: &networking.TrafficPolicy{

			b.failoverPriorityLabels = util.GetFailoverPriorityLabels(b.proxy.Labels, lbSetting.FailoverPriority)
		}
	}
}

func (b *EndpointBuilder) DestinationRule() *v1alpha3.DestinationRule {
	if dr := b.destinationRule.GetRule(); dr != nil {
		dr, _ := dr.Spec.(*v1alpha3.DestinationRule)
		return dr
	}
	return nil
}

func (b *EndpointBuilder) Type() string {
	return model.EDSType
}

apiVersion: networking.istio.io/v1beta1
kind: DestinationRule
metadata:
  name: "default"
spec:
  host: "*"
  trafficPolicy:
    tls:
      mode: {{ .TLSMode }}
---
# Apply a local policy to the system namespace to turn this off
# Otherwise, the eastwest gateway will be impacted
apiVersion: networking.istio.io/v1beta1
kind: DestinationRule
metadata:
  name: "eastwest-opt-out"
spec:
  exportTo: [.]
  host: "*"

apiVersion: networking.istio.io/v1beta1
kind: DestinationRule
metadata:
  name: passthrough
spec:
  host: "*"
  trafficPolicy:
    loadBalancer:
      simple: PASSTHROUGH
---
# Apply a local policy to the system namespace to turn this off
# Otherwise, the eastwest gateway will be impacted
apiVersion: networking.istio.io/v1beta1
kind: DestinationRule
metadata:
  name: "eastwest-opt-out"
  annotations:
    test-suite: "beta-mtls-on"

  This means server certificates will be automatically verified using the OS CA certificates when not using a DestinationRule caCertificates field.
  If undesired please use the new `compatibilityVersion` feature to fallback to old behavior, or `insecureSkipVerify`
  field in DestinationRule to skip the verification.
upgradeNotes:
- title: Default value of the feature flag `VERIFY_CERT_AT_CLIENT` is set to true
  content: |

)

type ApplyFunc = func(tcpProxy *tcp.TcpProxy, destinationRule *networking.DestinationRule, subsetName string)

// Apply configures tunneling_config in a given TcpProxy depending on the destination rule and the destination hosts
var Apply ApplyFunc = func(tcpProxy *tcp.TcpProxy, destinationRule *networking.DestinationRule, subsetName string) {
	var tunnelSettings *networking.TrafficPolicy_TunnelSettings

						name            string
						destinationRule string
						expectSuccess   bool
					}{
						{
							name:            "connection fails when DR doesn't match SA",
							destinationRule: defaultIdentityDR,
							expectSuccess:   false,
						},
						{
							name:            "connection succeeds when DR matches SA",
							destinationRule: correctIdentityDR,
							expectSuccess:   true,

										},
										Weight: 50,
									},
								},
							},
						},
					},
				},
				&v1alpha3.DestinationRule{
					ObjectMeta: metav1.ObjectMeta{
						Name:      "productpage",
						Namespace: "default",
					},
					Spec: v1alpha32.DestinationRule{
						Host: "productpage",
						Subsets: []*v1alpha32.Subset{
							{
								Name:   "v1",

apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
  name: productpage
spec:
  host: productpage
  subsets:
  - name: v1
    labels:
      version: v1
---
apiVersion: networking.istio.io/v1alpha3
kind: DestinationRule
metadata:
  name: reviews
spec:
  host: reviews
  subsets:
  - name: v1
    labels:
      version: v1
  - name: v2
    labels:
      version: v2
  - name: v3