var (
    SidecarInject                = workloadAnnotation(annotation.SidecarInject.Name, "true")
    SidecarRewriteAppHTTPProbers = workloadAnnotation(annotation.SidecarRewriteAppHTTPProbers.Name, "")
    SidecarBootstrapOverride     = workloadAnnotation(annotation.SidecarBootstrapOverride.Name, "")
    SidecarVolumeMount           = workloadAnnotation(annotation.SidecarUserVolumeMount.Name, "")
    SidecarVolume                = workloadAnnotation(annotation.SidecarUserVolume.Name, "")
    SidecarConfig                = workloadAnnotation(annotation.ProxyConfig.Name, "")
    SidecarInterceptionMode      = workloadAnnotation(annotation.SidecarInterceptionMode.Name, "REDIRECT")
)

type Annotation struct {
    Name    string
    Type    AnnotationType
    Default AnnotationValue
}

type AnnotationType string

const (
    WorkloadAnnotation AnnotationType = "workload"
)

type AnnotationValue struct {
    Value string
}

type Annotations map[Annotation]*AnnotationValue

type Builder interface {
    // With adds a new Echo configuration to the Builder. Once built, the instance
    // pointer will be updated to point at the new Instance.
    With(i *Instance, cfg Config) Builder

    // Build and initialize all Echo Instances. Upon returning, the Instance pointers
    // are assigned and all Instances are ready to communicate with each other.
    Build() (Instances, error)
    BuildOrFail(t test.Failer) Instances
}

type CallOptions struct {
    // Target instance of the call. Required.
    Target Instance

    // Port on the target Instance. Either Port or PortName must be specified.
    Port *Port

    // PortName of the port on the target Instance. Either Port or PortName must be specified.
    PortName string

    // Scheme to be used when making the call. If not provided, an appropriate default for the
    // port will be used (if feasible).
    Scheme scheme.Instance

    // If true, h2c will be used in HTTP requests
    HTTP2 bool

    // Address specifies the host name or IP address to be used on the request. If not provided,
    // an appropriate default is chosen for the target Instance.
    Address string

    // Path specifies the URL path for the HTTP(s) request.
    Path string

    // Count indicates the number of exchanges that should be made with the service endpoint.
    // If Count <= 0, defaults to 1.
    Count int

    // Headers indicates headers that should be sent in the request. Ignored for WebSocket calls.
    // If no Host header is provided, a default will be chosen for the target service endpoint.
    Headers http.Header

    // Timeout used for each individual request. Must be > 0, otherwise 30 seconds is used.
    Timeout time.Duration

    // Message to be sent if this is a GRPC request
    Message string

    // Method to send. Defaults to HTTP. Only relevant for HTTP.
    Method string

    // Use the custom certificate to make the call. This is mostly used to make mTLS request directly
    // (without proxy) from naked client to test certificates issued by custom CA instead of the Istio self-signed CA.
    Cert, Key, CaCert string

    // FollowRedirects will instruct the call to follow 301 redirects. Otherwise, the original 301 response
    // is returned directly.
    FollowRedirects bool

    // Validator for server responses. If no validator is provided, only the number of responses received
    // will be verified.
    Validator Validator
}

type Config struct {
    // Namespace of the echo Instance. If not provided, a default namespace "apps" is used.
    Namespace namespace.Instance

    // DefaultHostHeader overrides the default Host header for calls (`service.namespace.svc.cluster.local`)
    DefaultHostHeader string

    // Domain of the echo Instance. If not provided, a default will be selected.
    Domain string

    // Service indicates the service name of the Echo application.
    Service string

    // Version indicates the version path for calls to the Echo application.
    Version string

    // Locality (k8s only) indicates the locality of the deployed app.
    Locality string

    // Headless (k8s only) indicates that no ClusterIP should be specified.
    Headless bool

    // ServiceAccount (k8s only) indicates that a service account should be created
    // for the deployment.
    ServiceAccount bool

    // Ports for this application. Port numbers may or may not be used, depending
    // on the implementation.
    Ports []Port

    // WorkloadOnlyPorts for ports only defined in the workload but not in the k8s service.
    // This is used to test the inbound pass-through filter chain.
    WorkloadOnlyPorts []WorkloadPort

    // ServiceAnnotations is annotations on service object.
    ServiceAnnotations Annotations

    // ReadinessTimeout specifies the timeout that we wait the application to
    // become ready.
    ReadinessTimeout time.Duration

    // Subsets contains the list of Subsets config belonging to this echo
    // service instance.
    Subsets []SubsetConfig

    // Cluster to be used in a multicluster environment
    Cluster resource.Cluster

    // TLS settings for echo server
    TLSSettings *common.TLSSettings

    // If enabled, echo will be deployed as a "VM". This means it will run Envoy in the same pod as echo,
    // disable sidecar injection, etc.
    DeployAsVM bool

    // If enabled, ISTIO_META_AUTO_REGISTER_GROUP will be set on the VM and the WorkloadEntry will be created automatically.
    AutoRegisterVM bool

    // The image name to be used to pull the image for the VM. `DeployAsVM` must be enabled.
    VMImage string

    // The set of environment variables to set for `DeployAsVM` instances.
    VMEnvironment map[string]string

    // If enabled, an additional ext-authz container will be included in the deployment. This is mainly used to test
    // the CUSTOM authorization policy when the ext-authz server is deployed locally with the application container in
    // the same pod.
    IncludeExtAuthz bool
}

type Instance interface {
    resource.Resource

    // Config returns the configuration of the Echo instance.
    Config() Config

    // Address of the service (e.g. Kubernetes cluster IP). May be "" if headless.
    Address() string

    // Workloads retrieves the list of all deployed workloads for this Echo service.
    // Guarantees at least one workload, if error == nil.
    Workloads() ([]Workload, error)
    WorkloadsOrFail(t test.Failer) []Workload

    // Call makes a call from this Instance to a target Instance.
    Call(options CallOptions) (client.ParsedResponses, error)
    CallOrFail(t test.Failer, options CallOptions) client.ParsedResponses

    // CallWithRetry is the same as call, except that it will attempt to retry based on the provided
    // options. If no options are provided, uses defaults.
    CallWithRetry(options CallOptions, retryOptions ...retry.Option) (client.ParsedResponses, error)
    CallWithRetryOrFail(t test.Failer, options CallOptions, retryOptions ...retry.Option) client.ParsedResponses

    // Restart restarts the workloads associated with this echo instance
    Restart() error
}

type Instances []Instance

type Matcher func(Instance) bool

type Port struct {
    // Name of this port
    Name string

    // Protocol to be used for the port.
    Protocol protocol.Instance

    // ServicePort number where the service can be reached. Does not necessarily
    // map to the corresponding port numbers for the instances behind the
    // service.
    ServicePort int

    // InstancePort number where this instance is listening for connections.
    // This need not be the same as the ServicePort where the service is accessed.
    InstancePort int

    // TLS determines whether the connection will be plain text or TLS. By default this is false (plain text).
    TLS bool

    // ServerFirst determines whether the port will use server first communication, meaning the client will not send the first byte.
    ServerFirst bool

    // InstanceIP determines if echo will listen on the instance IP, or wildcard
    InstanceIP bool
}

type Sidecar interface {
    // NodeID returns the node ID used for uniquely identifying this sidecar to Pilot.
    NodeID() string

    // Info about the Envoy instance.
    Info() (*envoyAdmin.ServerInfo, error)
    InfoOrFail(t test.Failer) *envoyAdmin.ServerInfo

    // Config of the Envoy instance.
    Config() (*envoyAdmin.ConfigDump, error)
    ConfigOrFail(t test.Failer) *envoyAdmin.ConfigDump

    // WaitForConfig queries the Envoy configuration an executes the given accept handler. If the
    // response is not accepted, the request will be retried until either a timeout or a response
    // has been accepted.
    WaitForConfig(accept func(*envoyAdmin.ConfigDump) (bool, error), options ...retry.Option) error
    WaitForConfigOrFail(t test.Failer, accept func(*envoyAdmin.ConfigDump) (bool, error), options ...retry.Option)

    // Clusters for the Envoy instance
    Clusters() (*envoyAdmin.Clusters, error)
    ClustersOrFail(t test.Failer) *envoyAdmin.Clusters

    // Listeners for the Envoy instance
    Listeners() (*envoyAdmin.Listeners, error)
    ListenersOrFail(t test.Failer) *envoyAdmin.Listeners

    // Logs returns the logs for the sidecar container
    Logs() (string, error)
    // LogsOrFail returns the logs for the sidecar container, or aborts if an error is found
    LogsOrFail(t test.Failer) string

    Stats() (map[string]*dto.MetricFamily, error)
    StatsOrFail(t test.Failer) map[string]*dto.MetricFamily
}

type SubsetConfig struct {
    // The version of the deployment.
    Version string
    // Annotations provides metadata hints for deployment of the instance.
    Annotations Annotations
}

type Validator interface {
    // Validate performs the validation check for this Validator.
    Validate(client.ParsedResponses, error) error
}

type ValidatorFunc func(client.ParsedResponses, error) error

type Workload interface {
    // PodName gets the original pod name for the workload.
    PodName() string
    // Address returns the network address of the endpoint.
    Address() string

    // Sidecar if one was specified.
    Sidecar() Sidecar

    // ForwardEcho executes specific call from this workload.
    ForwardEcho(context.Context, *proto.ForwardEchoRequest) (client.ParsedResponses, error)

    // Logs returns the logs for the app container
    Logs() (string, error)
    // LogsOrFail returns the logs for the app container, or aborts if an error is found
    LogsOrFail(t test.Failer) string
}

type WorkloadPort struct {
    // Port number
    Port int

    // Protocol to be used for this port.
    Protocol protocol.Instance

    // TLS determines whether the connection will be plain text or TLS. By default this is false (plain text).
    TLS bool

    // ServerFirst determines whether the port will use server first communication, meaning the client will not send the first byte.
    ServerFirst bool
}