{Number: 8080, Protocol: "http", Name: "http-valid2"},
				},
				WorkloadSelector: &networking.WorkloadSelector{},
			},
			valid:   true,
			warning: true,
		},
		{
			name: "selector and endpoints", in: &networking.ServiceEntry{
				Hosts:            []string{"google.com"},
				WorkloadSelector: &networking.WorkloadSelector{Labels: map[string]string{"foo": "bar"}},
				Ports: []*networking.ServicePort{

		rule, ok := cfg.Spec.(*networking.Sidecar)
		if !ok {
			return nil, fmt.Errorf("cannot cast to Sidecar")
		}

		warning, err := ValidateAlphaWorkloadSelector(rule.WorkloadSelector)
		if err != nil {
			return nil, err
		}

		// If workloadSelector is defined and labels are not set, it is most likely
		// an user error. Marking it as a warning to keep it backwards compatible.
		if warning != nil {

        typed_config:
          '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
          xff_num_trusted_hops: 1
          normalize_path: true
  workloadSelector:
    labels:
      istio: {{.GatewayIstioLabel | default "ingressgateway"}}
---
` + httpVirtualServiceTmpl,
		opts: echo.CallOptions{
			Count: 1,
			Port: echo.Port{

						SubjectAltNames:    []string{"foo.default.svc.cluster.local"},
						InsecureSkipVerify: &wrappers.BoolValue{Value: true},
					},
				},
				WorkloadSelector: &v1beta1.WorkloadSelector{},
			},
			enableAutoSni:            false,
			enableVerifyCertAtClient: true,
			expectTLSContext: &tls.UpstreamTlsContext{
				CommonTlsContext: &tls.CommonTlsContext{

Specifies a host to which the downstream connection is tunneled. type: string targetPort: description: Specifies a port to which the downstream connection is tunneled. type: integer required: - targetHost - targetPort type: object type: object workloadSelector: description: Criteria used to select the specific set of pods/VMs on which this `DestinationRule` configuration should be applied. properties: matchLabels: additionalProperties: type: string description: One or more labels that indicate a specific...

					},
				},
			},
		},
	}

	// This workload-level beta policy doesn't affect CDS (yet).
	peerAuthn := &authn_beta.PeerAuthentication{
		Selector: &selectorpb.WorkloadSelector{
			MatchLabels: map[string]string{
				"version": "v1",
			},
		},
		Mtls: &authn_beta.PeerAuthentication_MutualTLS{
			Mode: authn_beta.PeerAuthentication_MutualTLS_STRICT,
		},
	}