defer sdsServer.Stop()

		Setup(t).Check(t, security.WorkloadKeyCertResourceName, security.RootCertReqResourceName)

		t.Cleanup(func() {
			_ = os.RemoveAll(dir)
		})
	})
	t.Run("Unhealthy SDS socket", func(t *testing.T) {
		dir := filepath.Dir(security.WorkloadIdentitySocketPath)
		os.MkdirAll(dir, 0o755)

		// starting an unresponsive listener on the socket

		return nil
	}
	// If we are more than timeout seconds after the lease duration that is past the timeout
	// on the lease renew. Time to start reporting ourselves as unhealthy. We should have
	// died but conditions like deadlock can prevent this. (See #70819)
	if le.clock.Since(le.observedTime) > le.config.LeaseDuration+maxTolerableExpiredLease {

        // Health is not ok

        // Log some diagnostic information to the console, in addition to aborting execution with an exception that will also be logged
        // Given that the execution infrastructure is in an unhealthy state, it may not shut down cleanly and report the execution.
        // So, log some details here just in case
        System.out.println(healthState.detailMessage);

			if err != nil {
				logger.Error(err, "Failed to get health of node", "node", klog.KRef("", string(attachedVolume.NodeName)))
			}

			// Force detach volumes from unhealthy nodes after maxWaitForUnmountDuration if force detach is enabled
			// Ensure that the timeout condition checks this correctly so that the correct metric is updated below

    assertThat(connection.openStreamCount()).isEqualTo(0)

    // When the timeout is sent the connection doesn't immediately go unhealthy.
    assertThat(connection.isHealthy(System.nanoTime())).isTrue()

    // But if the ping doesn't arrive, the connection goes unhealthy.
    Thread.sleep(TimeUnit.NANOSECONDS.toMillis(Http2Connection.DEGRADED_PONG_TIMEOUT_NS.toLong()))

			Changed:       true,
			OldConditions: []v1.NodeCondition{},
			NewConditions: []v1.NodeCondition{{Type: v1.NodeReady, Status: v1.ConditionTrue}},
		},
		{
			Name:          "new node has less unhealthy conditions",
			Changed:       true,
			OldConditions: []v1.NodeCondition{{Type: v1.NodeDiskPressure, Status: v1.ConditionTrue}},
			NewConditions: []v1.NodeCondition{},
		},
		{

	// ClusterID where the endpoint is located
	ClusterID cluster.ID
}

// Endpoint health status.
type HealthStatus int32

const (
	// Healthy.
	Healthy HealthStatus = 1
	// Unhealthy.
	UnHealthy HealthStatus = 2
	// Draining - the constant matches envoy
	Draining HealthStatus = 3
)

// IstioEndpoint defines a network address (IP:port) associated with an instance of the

	})

	t.Run("Service selects WorkloadEntry: health status", func(t *testing.T) {
		store, kube, fx := setupTest(t)
		makeService(t, kube, service)

		// Start as unhealthy, should have no instances
		makeIstioObject(t, store, setHealth(workloadEntry, false))
		instances := []EndpointResponse{}
		expectServiceEndpoints(t, fx, expectedSvc, 80, instances)

		// Mark healthy, get instances

	WorkloadStatus_HEALTHY WorkloadStatus = 0
	// Workload is unhealthy and NOT ready to serve traffic.
	WorkloadStatus_UNHEALTHY WorkloadStatus = 1
)

// Enum value maps for WorkloadStatus.
var (
	WorkloadStatus_name = map[int32]string{
		0: "HEALTHY",
		1: "UNHEALTHY",
	}
	WorkloadStatus_value = map[string]int32{
		"HEALTHY":   0,
		"UNHEALTHY": 1,
	}
)

func (x WorkloadStatus) Enum() *WorkloadStatus {

	}
	// test the handlers
	testHandler(hcs, nsn2, http.StatusServiceUnavailable, 0, t)
	testHandler(hcs, nsn3, http.StatusOK, 7, t)
	testHandler(hcs, nsn4, http.StatusOK, 6, t)

	// fake a temporary unhealthy proxy
	proxyChecker.healthy = false
	testHandlerWithHealth(hcs, nsn2, http.StatusServiceUnavailable, 0, false, t)
	testHandlerWithHealth(hcs, nsn3, http.StatusServiceUnavailable, 7, false, t)