scopes.Framework.Errorf("failed resetting waypoint for %s/%s; this will likely break other tests", ns.Name(), service)
			}
		})

	}
}

func DeleteWaypoint(t framework.TestContext, ns namespace.Instance, waypoint string) {
	istioctl.NewOrFail(t, t, istioctl.Config{}).InvokeOrFail(t, []string{
		"waypoint",
		"delete",
		"--namespace",
		ns.Name(),
		waypoint,
	})

        service.istio.io/canonical-revision: latest
        sidecar.istio.io/inject: "false"
        topology.istio.io/network: network-1
    spec:
      containers:
      - args:
        - proxy
        - waypoint
        - --domain
        - $(POD_NAMESPACE).svc.<no value>
        - --serviceCluster
        - namespace.$(POD_NAMESPACE)
        - --proxyLogLevel
        - <nil>
        - --proxyComponentLogLevel

        service.istio.io/canonical-revision: latest
        sidecar.istio.io/inject: "false"
        topology.istio.io/network: network-1
    spec:
      containers:
      - args:
        - proxy
        - waypoint
        - --domain
        - $(POD_NAMESPACE).svc.<no value>
        - --serviceCluster
        - namespace.$(POD_NAMESPACE)
        - --proxyLogLevel
        - <nil>
        - --proxyComponentLogLevel

			}
		}
		waypointKey := ""
		waypoint := fetchWaypointForService(ctx, Waypoints, Namespaces, s.ObjectMeta)
		if waypoint != nil {
			waypointKey = waypoint.ResourceName()
		}
		a.networkUpdateTrigger.MarkDependant(ctx) // Mark we depend on out of band a.Network
		return &model.ServiceInfo{
			Service:       a.constructService(s, waypoint),
			PortNames:     portNames,

	return AuthzDerivedPolicies, Policies
}

func implicitWaypointPolicyName(waypoint *Waypoint) string {
	if !features.DefaultAllowFromWaypoint || waypoint == nil || len(waypoint.ServiceAccounts) == 0 {
		return ""
	}
	// use '_' character since those are illegal in k8s names
	return "istio_allow_waypoint_" + waypoint.Namespace + "_" + waypoint.Name
}

		return iNode < jNode
	})

	fmt.Fprintln(w, "NAMESPACE\tPOD NAME\tIP\tNODE\tWAYPOINT\tPROTOCOL")

	for _, wl := range verifiedWorkloads {
		var ip string
		if len(wl.WorkloadIPs) > 0 {
			ip = wl.WorkloadIPs[0]
		}
		waypoint := waypointName(wl, zDump.Services)
		fmt.Fprintf(w, "%v\t%v\t%v\t%v\t%v\t%v\n",
			wl.Namespace, wl.Name, ip, wl.Node, waypoint, wl.Protocol)

	}
	return w.Flush()
}

	Zone    string `json:"zone,omitempty"`
	Subzone string `json:"subzone,omitempty"`
}

type ZtunnelWorkload struct {
	WorkloadIPs           []string          `json:"workloadIps"`
	Waypoint              *GatewayAddress   `json:"waypoint,omitempty"`
	NetworkGateway        *GatewayAddress   `json:"networkGateway,omitempty"`
	Protocol              string            `json:"protocol"`
	Name                  string            `json:"name"`

	})
	fmt.Fprintln(w, "NAMESPACE\tSERVICE NAME\tSERVICE VIP\tWAYPOINT")

	for _, svc := range svcs {
		var ip string
		if len(svc.Addresses) > 0 {
			_, ip, _ = strings.Cut(svc.Addresses[0], "/")
		}
		waypoint := serviceWaypointName(svc, zDump.Services)
		fmt.Fprintf(w, "%v\t%v\t%v\t%v\n",
			svc.Namespace, svc.Name, ip, waypoint)
	}
	return w.Flush()
}

apiVersion: release-notes/v2
kind: feature
area: istioctl
issue:
  - 51312

releaseNotes:
  - |

					targetType:   "gateway",
					targetName:   fmt.Sprintf("%s-gateway", GetTarget().(echo.Instances).ServiceName()),
				},
				{
					desc:       "Configure WebAssembly filter for waypoint",
					name:       "waypoint-wasm-test",
					targetType: "gateway",
					targetName: constants.DefaultNamespaceWaypoint,
				},
				{
					desc:       "Configure WebAssembly filter for specific service",