ClusterID: c.Cluster(),
		},
		tlsMode:  model.GetTLSModeFromEndpointLabels(proxy.Labels),
		nodeName: proxy.GetNodeName(),
	}
	var networkID network.ID
	if len(proxy.IPAddresses) > 0 {
		networkID = out.endpointNetwork(proxy.IPAddresses[0])
	}
	out.labels = labelutil.AugmentLabels(proxy.Labels, c.Cluster(), locality, out.nodeName, networkID)
	return out
}

func (b *EndpointBuilder) buildIstioEndpoint(

		"missing group":      {IPAddresses: []string{"1.2.3.4"}, Metadata: &model.NodeMetadata{Namespace: wgA.Namespace}},
		"missing ip":         {Metadata: &model.NodeMetadata{Namespace: wgA.Namespace, AutoRegisterGroup: wgA.Name}},
		"missing namespace":  {IPAddresses: []string{"1.2.3.4"}, Metadata: &model.NodeMetadata{AutoRegisterGroup: wgA.Name}},

func TestServiceScoping(t *testing.T) {
	baseProxy := func() *model.Proxy {
		return &model.Proxy{
			Metadata:        &model.NodeMetadata{},
			ID:              "app.app",
			Type:            model.SidecarProxy,
			IPAddresses:     []string{"1.1.1.1"},
			ConfigNamespace: "app",
		}
	}

	t.Run("STATIC", func(t *testing.T) {
		s := xds.NewFakeDiscoveryServer(t, xds.FakeOptions{
			ConfigString: scopeConfig,

	go servicecidrs.NewController(
		ctx,
		controllerContext.InformerFactory.Networking().V1alpha1().ServiceCIDRs(),
		controllerContext.InformerFactory.Networking().V1alpha1().IPAddresses(),
		controllerContext.ClientBuilder.ClientOrDie("service-cidrs-controller"),
	).Run(ctx, 5)
	// TODO use component config
	return nil, true, nil

		BasicConstraintsValid: true,
		IsCA:                  true,
	}

	if ip := netutils.ParseIPSloppy(host); ip != nil {
		template.IPAddresses = append(template.IPAddresses, ip)
	} else {
		template.DNSNames = append(template.DNSNames, host)
	}

	template.IPAddresses = append(template.IPAddresses, alternateIPs...)
	template.DNSNames = append(template.DNSNames, alternateDNS...)

			PurgeInterval:         wasmPurgeInterval,
			HTTPRequestTimeout:    wasmHTTPRequestTimeout,
			HTTPRequestMaxRetries: wasmHTTPRequestMaxRetries,
		},
		ProxyIPAddresses:            proxy.IPAddresses,
		ServiceNode:                 proxy.ServiceNode(),
		EnvoyStatusPort:             envoyStatusPortEnv,
		EnvoyPrometheusPort:         envoyPrometheusPortEnv,
		MinimumDrainDuration:        minimumDrainDurationEnv,

		want  []model.ServiceTarget
	}{
		{
			name:  "proxy with unspecified IP",
			proxy: &model.Proxy{Metadata: &model.NodeMetadata{}, IPAddresses: nil},
			want:  nil,
		},
		{
			name:  "proxy with IP not in the registry",
			proxy: &model.Proxy{Metadata: &model.NodeMetadata{}, IPAddresses: []string{"1.1.1.1"}},
			want:  nil,
		},
		{
			name:  "proxy with IP from the registry, 1 matching WE, but no matching Service",

	c := &Controller{
		client: client,
		queue: workqueue.NewTypedRateLimitingQueueWithConfig(
			workqueue.DefaultTypedControllerRateLimiter[string](),
			workqueue.TypedRateLimitingQueueConfig[string]{Name: "ipaddresses"},
		),
		tree:             iptree.New[sets.Set[string]](),
		workerLoopPeriod: time.Second,
	}

	_, _ = serviceCIDRInformer.Informer().AddEventHandler(cache.ResourceEventHandlerFuncs{

				Labels: map[string]string{
					"merge": "wg",
					"wg":    "1",
				},
			},
		},
		Status: nil,
	})
	proxy := &model.Proxy{
		Labels:      map[string]string{"merge": "me"},
		IPAddresses: []string{"1.1.1.1"},
		Metadata: &model.NodeMetadata{
			AutoRegisterGroup: "wg",
			Namespace:         "namespace",
			Network:           "network1",
			Labels:            map[string]string{"merge": "meta", "meta": "2"},

	pr := &model.Proxy{
		Type:        model.SidecarProxy,
		IPAddresses: []string{"2001:1::1"},
		Metadata: &model.NodeMetadata{
			Namespace: "not-default",
		},
		ConfigNamespace: "not-default",
	}
	return pr
}

var (
	tnow        = time.Now()
	proxyHTTP10 = model.Proxy{
		Type:        model.SidecarProxy,
		IPAddresses: []string{"1.1.1.1"},
		ID:          "v0.default",