isZtunnel := strings.HasPrefix(podName, "ztunnel")
	if client == nil {
		return isZtunnel
	}
	pod, err := client.Kube().CoreV1().Pods(podNamespace).Get(context.Background(), podName, metav1.GetOptions{})
	if err != nil {
		return isZtunnel
	}
	if v, ok := pod.Labels["app"]; ok {
		return v == "ztunnel"
	}
	return isZtunnel
}

		if isProxy(con) || isZtunnel(con) {
			xdsConfigs := make([]*status.ClientConfig_GenericXdsConfig, 0)
			for _, stype := range stypes {
				pxc := &status.ClientConfig_GenericXdsConfig{}
				if watchedResource, ok := con.proxy.WatchedResources[stype]; ok {
					pxc.ConfigStatus = debugSyncStatus(watchedResource)
				} else if isZtunnel(con) {
					pxc.ConfigStatus = status.ConfigStatus_UNKNOWN

func ConfigAffectsProxy(req *model.PushRequest, proxy *model.Proxy) bool {
	// Empty changes means "all" to get a backward compatibility.
	if len(req.ConfigsUpdated) == 0 {
		return true
	}
	if proxy.IsWaypointProxy() || proxy.IsZTunnel() {
		// Optimizations do not apply since scoping uses different mechanism
		// TODO: implement ambient aware scoping
		return true
	}

	for config := range req.ConfigsUpdated {

        }
        return testProxyServer
    }

    abstract MavenHttpRepository getRepo()
    abstract String getProxyScheme()
    abstract String getRepoServerUrl()
    abstract boolean isTunnel()
    abstract void setupServer()

    def setup() {
        module = repo.module("org.gradle.test", "some-lib", "1.2.17").publish()
        buildFile << """
configurations { compile }

    }

    @Override
    String getProxyScheme() {
        return 'http'
    }

    @Override
    String getRepoServerUrl() {
        mavenHttpRepo.uri
    }

    @Override
    boolean isTunnel() { false }

    @Override
    void setupServer() {}

    String getProxyScheme() {
        return 'https'
    }

    @Override
    String getRepoServerUrl() {
        "https://localhost:${server.sslPort}/repo"
    }

    @Override
    boolean isTunnel() { true }

    @Override
    void setupServer() {
        keyStore = TestKeyStore.init(resources.dir)
        keyStore.enableSslWithServerCert(server)
        keyStore.configureServerCert(executer)
    }

    when (socketPolicy) {
      SocketPolicy.EXPECT_CONTINUE, SocketPolicy.CONTINUE_ALWAYS -> {
        result.add100Continue()
        KeepOpen
      }
      SocketPolicy.UPGRADE_TO_SSL_AT_END -> {
        result.inTunnel()
        KeepOpen
      }
      else -> wrapSocketPolicy()
    }
  result.throttleBody(throttleBytesPerPeriod, getThrottlePeriod(MILLISECONDS), MILLISECONDS)
  result.bodyDelay(getBodyDelay(MILLISECONDS), MILLISECONDS)

          handshakeCertificates.sslSocketFactory(),
          handshakeCertificates.trustManager,
        )
        .proxy(server.toProxyAddress())
        .build()

    server.enqueue(MockResponse(inTunnel = true))
    server.enqueue(MockResponse())

    val call =
      client.newCall(
        Request(
          url =
            server.url("/").newBuilder()
              .host(hostnameOrIpAddress)

	if insecureSkipTLSVerify {
		transportConfig.TLS.Insecure = true
		transportConfig.TLS.CAFile = "" // we are only using files so we can ignore CAData
	}

	if config.Lookup != nil {
		// Assuming EgressSelector if SSHTunnel is not turned on.
		// We will not get a dialer if egress selector is disabled.
		networkContext := egressselector.Cluster.AsNetworkContext()
		dialer, err := config.Lookup(networkContext)
		if err != nil {