Mode mode = 2;
}

// Workload represents a workload - an endpoint (or collection behind a hostname).
// The xds primary key is "uid" as defined on the workload below.
// Secondary (alias) keys are the unique `network/IP` pairs that the workload can be reached at.
message Workload {
  // UID represents a globally unique opaque identifier for this workload.

	namespace = ctx.Namespace()
	workloadCmd := &cobra.Command{
		Use:   "workload",
		Short: "Commands to assist in configuring and deploying workloads running on VMs and other non-Kubernetes environments",
		Example: `  # workload group yaml generation
  istioctl x workload group create

  # workload entry configuration generation
  istioctl x workload entry configure`,
	}
	workloadCmd.AddCommand(groupCommand(ctx))

	// lookup by address should return the workload entry's address info
	assert.Equal(t, s.lookup(s.addrXdsName("140.140.0.10")), []model.AddressInfo{{
		Address: &workloadapi.Address{
			Type: &workloadapi.Address_Workload{
				Workload: &workloadapi.Workload{
					Uid:               s.wleXdsName("name0"),
					Name:              "name0",
					Namespace:         testNS,
					Addresses:         [][]byte{parseIP("140.140.0.10")},

                        "healthStatus": "HEALTHY",
                        "metadata": {
                            "filterMetadata": {
                                "istio": {
                                    "workload": "cert-manager-istio-csr;cert-manager;;;Kubernetes"
                                }
                            }
                        },
                        "loadBalancingWeight": 1
                    }

          istio:
            workload: coredns;kube-system;;;Kubernetes
    - endpoint:
        address:
          socketAddress:
            address: 10.244.0.3
            portValue: 53
        healthCheckConfig: {}
      healthStatus: HEALTHY
      loadBalancingWeight: 1
      metadata:
        filterMetadata:
          istio:
            workload: coredns;kube-system;;;Kubernetes

	weightedExpectations map[string][]xdstest.LocLbEpInfo
}

func (w *workload) Expect(target *workload, ips ...string) {
	if w.expectations == nil {
		w.expectations = map[string][]string{}
	}
	w.expectations[target.clusterName("")] = ips
}

func (w *workload) ExpectWithWeight(target *workload, subset string, eps ...xdstest.LocLbEpInfo) {
	if w.weightedExpectations == nil {

		SuggestedFlowSchemaKubeControllerManager,     // references "workload-high" priority-level
		SuggestedFlowSchemaKubeScheduler,             // references "workload-high" priority-level
		SuggestedFlowSchemaKubeSystemServiceAccounts, // references "workload-high" priority-level
		SuggestedFlowSchemaServiceAccounts,           // references "workload-low" priority-level

		a.serviceEntryWorkloadBuilder(MeshConfig, AuthorizationPolicies, PeerAuths, Waypoints, Namespaces),
		krt.WithName("ServiceEntryWorkloads"),
	)
	Workloads := krt.JoinCollection([]krt.Collection[model.WorkloadInfo]{PodWorkloads, WorkloadEntryWorkloads, ServiceEntryWorkloads}, krt.WithName("Workloads"))
	return Workloads
}

func (a *index) workloadEntryWorkloadBuilder(
	MeshConfig krt.Singleton[MeshConfig],

            timeoutSeconds: 3
          volumeMounts:
          - mountPath: /var/run/secrets/workload-spiffe-uds
            name: workload-socket
          - mountPath: /var/run/secrets/credential-uds
            name: credential-socket
          - mountPath: /var/run/secrets/workload-spiffe-credentials
            name: workload-certs
          - mountPath: /var/run/secrets/istio
            name: istiod-ca-cert

	store model.ConfigStoreController

	// Note: unregister is to update the workload entry status: like setting `istio.io/disconnectedAt`
	// and make the workload entry enqueue `cleanupQueue`
	// cleanup is to delete the workload entry

	// queue contains workloadEntry that need to be unregistered
	queue controllers.Queue