}
}

type WasmPluginListenerInfo struct {
	Port  int
	Class istionetworking.ListenerClass

	// Service that WasmPlugins can attach to via targetRefs (optional)
	Service *Service
}

// If anyListener is used as a listener info,
// the listener is matched with any TrafficSelector.
var anyListener = WasmPluginListenerInfo{
	Port:  0,

			given: []v1.EndpointSubset{{
				Addresses: []v1.EndpointAddress{
					{IP: "1.2.3.4", TargetRef: &fooObjRef},
					{IP: "1.2.3.4", TargetRef: &barObjRef},
				},
				Ports: []v1.EndpointPort{{Port: 111}},
			}},
			expect: []v1.EndpointSubset{{
				Addresses: []v1.EndpointAddress{{IP: "1.2.3.4", TargetRef: &fooObjRef}},
				Ports:     []v1.EndpointPort{{Port: 111}},
			}},
		}, {

							},
						},
					},
				},
				{
					Meta: config.Meta{
						GroupVersionKind: gvk.RequestAuthentication,
						Name:             "with-targetref",
						Namespace:        "foo",
					},
					Spec: &securityBeta.RequestAuthentication{
						TargetRef: &selectorpb.PolicyTargetReference{
							Group: gvk.KubernetesGateway.Group,
							Kind:  gvk.KubernetesGateway.Kind,
							Name:  "my-gateway",
						},

// * It is an endpoint with an associate Pod, but its not found.
func (c *Controller) getPod(ip string, namespace string, targetRef *corev1.ObjectReference) *corev1.Pod {
	if targetRef != nil && targetRef.Kind == "Pod" {
		key := types.NamespacedName{Name: targetRef.Name, Namespace: targetRef.Namespace}
		pod := c.pods.getPodByKey(key)
		return pod
	}
	// This means the endpoint is manually controlled

	policyWithTargetRef.TargetRef = &selectorpb.PolicyTargetReference{
		Group:     gvk.KubernetesGateway.Group,
		Kind:      gvk.KubernetesGateway.Kind,
		Name:      "my-gateway",
		Namespace: "bar",
	}

	policyWithServiceRef := proto.Clone(policy).(*authpb.AuthorizationPolicy)
	policyWithServiceRef.TargetRef = &selectorpb.PolicyTargetReference{
		Group:     gvk.Service.Group,

	if pod == nil {
		return fmt.Errorf("pod is missing, skipping (%s/%s)", addr.TargetRef.Namespace, addr.TargetRef.Name)
	}
	for _, podIP := range pod.Status.PodIPs {
		if podIP.IP == addr.IP {
			return nil
		}
	}
	return fmt.Errorf("pod ip(s) doesn't match endpoint ip, skipping: %v vs %s (%s/%s)", pod.Status.PodIPs, addr.IP, addr.TargetRef.Namespace, addr.TargetRef.Name)
}

			IP: address,
			TargetRef: &corev1.ObjectReference{
				Kind: "Pod",
				Name: fmt.Sprintf("pod-%d", i),
			},
		}

		subset.Addresses = append(subset.Addresses, endpointAddress)

		epSlice.Endpoints = append(epSlice.Endpoints, discovery.Endpoint{
			Addresses:  []string{endpointAddress.IP},
			TargetRef:  endpointAddress.TargetRef,

			t.NewSubTest("enabled").Run(func(t framework.TestContext) {
				applyTelemetryResource(t, true)
				runAccessLogsTests(t, true, false)
				deleteTelemetryResource(t, true)
			})
			t.NewSubTest("enabled-with-targetref").Run(func(t framework.TestContext) {
				args := map[string]any{
					"To":                GetTarget().(echo.Instances),
					"TargetGatewayName": GetTarget().ServiceName() + "-gateway",

		telemetryKey: telemetryKey{
			Workload: namespacedName,
		},
		Logging: []*tpb.AccessLogging{
			emptyEnvoyLogging,
		},
	}
	validTelemetryConfigurationWithTargetRef := &tpb.Telemetry{
		TargetRef: &v1beta1.PolicyTargetReference{
			Group: gvk.KubernetesGateway.Group,
			Kind:  gvk.KubernetesGateway.Kind,
			Name:  "my-gateway",
		},
		Tracing: []*tpb.Tracing{
			emptyStackDriverTracing,
		},

		"If disabled, Gateway API gateways will ignore workloadSelector policies, only"+
			"applying policies that select the gateway with a targetRef.").Get()

	// Useful for IPv6-only EKS clusters. See https://aws.github.io/aws-eks-best-practices/networking/ipv6/ why it assigns an additional IPv4 NAT address.