OutboundTrafficPolicy: &networking.OutboundTrafficPolicy{
				Mode: networking.OutboundTrafficPolicy_ALLOW_ANY,
			},
			Egress: []*networking.IstioEgressListener{
				{
					Hosts: []string{"*/*"},
				},
			},
		}, true, false},
		{"sidecar egress proxy with RESGISTRY_ONLY(default)", &networking.Sidecar{
			OutboundTrafficPolicy: &networking.OutboundTrafficPolicy{

	// Let us enable outboundTrafficPolicy REGISTRY_ONLY
	// on one of the workloads, to verify selective external connectivity
	SidecarScope := fmt.Sprintf(`apiVersion: networking.istio.io/v1alpha3
kind: Sidecar
metadata:
  name: restrict-external-service
  namespace: %s
spec:
  workloadSelector:
    labels:
      app: a
  outboundTrafficPolicy:
    mode: "REGISTRY_ONLY"

				}
			}
		}

		errs = AppendValidation(errs, validateSidecarOutboundTrafficPolicy(rule.OutboundTrafficPolicy))

		return errs.Unwrap()
	})

func validateSidecarOutboundTrafficPolicy(tp *networking.OutboundTrafficPolicy) (errs error) {
	if tp == nil {
		return
	}
	mode := tp.GetMode()
	if tp.EgressProxy != nil {