Additionally, we enforce the peer has a valid mesh identity (but do not assert _which_ identity, yet).

Next, we terminate the CONNECT.
From the [headers](#headers), we know the target destination.
If the target destination has a waypoint, we enforce that the request is coming from that waypoint. Otherwise, the request is rejected.
If there is no waypoint, ztunnel will enforce RBAC policies against the request.

			b, err := yaml.Marshal(gw)
			if err != nil {
				return err
			}
			_, err = gwc.Patch(context.Background(), gw.Name, types.ApplyPatchType, b, metav1.PatchOptions{
				Force:        nil,
				FieldManager: "istioctl",
			})
			if err != nil {
				if errors.IsNotFound(err) {
					return fmt.Errorf("missing Kubernetes Gateway CRDs need to be installed before applying a waypoint: %s", err)

	// SkipConfirmation determines whether the user is prompted for confirmation.
	// If set to true, the user is not prompted and a Yes response is assumed in all cases.
	SkipConfirmation bool
	// Force proceeds even if there are validation errors
	Force bool
	// Verify after installation
	Verify bool
	// Set is a string with element format "path=value" where path is an IstioOperator path and the value is a
	// value to set the node at that path to.

  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;

  // spec defines the policy enforced.
  // +optional
  optional PodSecurityPolicySpec spec = 2;
}

// PodSecurityPolicyList is a list of PodSecurityPolicy objects.
message PodSecurityPolicyList {
  // Standard list metadata.

	testResourceFile := "duplicate_mwc"

	testCases := []struct {
		name       string
		force      bool
		assertFunc func(g *WithT, objs *ObjectSet, err error)
	}{
		{
			name:  "Duplicate MutatingWebhookConfiguration should be allowed when --force is enabled",
			force: true,
			assertFunc: func(g *WithT, objs *ObjectSet, err error) {
				g.Expect(err).Should(BeNil())

  // validationActions declares how Validations of the referenced ValidatingAdmissionPolicy are enforced.
  // If a validation evaluates to false it is always enforced according to these actions.
  //
  // Failures defined by the ValidatingAdmissionPolicy's FailurePolicy are enforced according
  // to these actions only if the FailurePolicy is set to Fail, otherwise the failures are