protocol: HTTPS
    - number: 9090
      name: auto
      protocol: ""
  resolution: STATIC
  location: MESH_INTERNAL
  endpoints:
    - address: 1.1.1.1
      labels:
        security.istio.io/tlsMode: istio
---
# Set up .Services number of services. Each will have 4 ports (one for each protocol)
{{- range $i := until .Services }}
apiVersion: networking.istio.io/v1alpha3
kind: ServiceEntry
metadata:

			DnsLookupFamily: cluster.Cluster_V4_ONLY,
			LbPolicy:        cluster.Cluster_ROUND_ROBIN,
			TransportSocketMatches: []*cluster.Cluster_TransportSocketMatch{
				{
					Name: "tlsMode-istio",
					TransportSocket: &core.TransportSocket{
						Name: "envoy.transport_sockets.tls",
						ConfigType: &core.TransportSocket_TypedConfig{
							TypedConfig: protoconv.MessageToAny(&tls.UpstreamTlsContext{

	}
	if first.Endpoint.Address != second.Endpoint.Address {
		return false
	}
	if first.Endpoint.Network != second.Endpoint.Network {
		return false
	}
	if first.Endpoint.TLSMode != second.Endpoint.TLSMode {
		return false
	}
	if !first.Endpoint.Labels.Equals(second.Endpoint.Labels) {
		return false
	}
	if first.Endpoint.ServiceAccount != second.Endpoint.ServiceAccount {
		return false
	}

		},
	}
}

// defaultTransportSocketMatch applies to endpoints that have no security.istio.io/tlsMode label
// or those whose label value does not match "istio"
func defaultTransportSocketMatch() *cluster.Cluster_TransportSocketMatch {
	return &cluster.Cluster_TransportSocketMatch{
		Name:            "tlsMode-disabled",
		Match:           &structpb.Struct{},
		TransportSocket: xdsfilters.RawBufferTransportSocket,
	}
}

  ports:
    - number: 80
      name: http
      protocol: HTTP
  resolution: STATIC
  location: MESH_INTERNAL
  endpoints:
    - address: 1.2.3.4
      labels:
        security.istio.io/tlsMode: istio
---
apiVersion: networking.istio.io/v1alpha3
kind: ServiceEntry
metadata:
  name: service-none-wildcard
  namespace: ns2
spec:
  hosts:
    - "*.random-4.host.example"

type Protocol string

const (
	HTTP  Protocol = "http"
	HTTP2 Protocol = "http2"
	TCP   Protocol = "tcp"
)

type TLSMode string

const (
	Plaintext TLSMode = "plaintext"
	TLS       TLSMode = "tls"
	MTLS      TLSMode = "mtls"
)

func (c Call) IsHTTP() bool {
	return httpProtocols.Contains(string(c.Protocol)) && (c.TLS == Plaintext || c.TLS == "")
}

					Endpoint: &model.IstioEndpoint{
						Address:        instance.address,
						Labels:         instance.labels,
						ServiceAccount: genTestSpiffe(selector.Name, instance.serviceAccount),
						TLSMode:        instance.tlsmode,
					},
				}

				callInstanceHandlers([]*model.WorkloadInstance{wi}, sd, model.EventAdd, t)

				totalInstances := []*model.ServiceInstance{}

// when TLS mode is SIMPLE or MUTUAL. If metadata is not initialized, builds a new metadata.
func AddALPNOverrideToMetadata(metadata *core.Metadata, tlsMode networking.ClientTLSSettings_TLSmode) *core.Metadata {
	if tlsMode != networking.ClientTLSSettings_SIMPLE && tlsMode != networking.ClientTLSSettings_MUTUAL {
		return metadata
	}

	if metadata == nil {
		metadata = &core.Metadata{

      creationTimestamp: null
      labels:
        app: hello
        security.istio.io/tlsMode: istio
        service.istio.io/canonical-name: hello
        service.istio.io/canonical-revision: v1
        tier: backend
        track: stable
        version: v1
    spec:
      containers:

        creationTimestamp: null
        labels:
          app: hello
          security.istio.io/tlsMode: istio
          service.istio.io/canonical-name: hello
          service.istio.io/canonical-revision: v1
          tier: backend
          track: stable
          version: v1
      spec:
        containers: