// Check that each response saw one of the workload IPs for the src echo instance
	addresses := sets.New(src.WorkloadsOrFail(t).Addresses()...)
	return check.Each(func(response echot.Response) error {
		if !addresses.Contains(response.IP) {
			return fmt.Errorf("expected original source (%v) to be propogated, but got %v", addresses.UnsortedList(), response.IP)
		}
		return nil
	})
}

				},
				Filter: &tpb.AccessLogging_Filter{
					Expression: "response.code >= 400",
				},
			},
		},
	}
	code500filter := &tpb.Telemetry{
		AccessLogging: []*tpb.AccessLogging{
			{
				Providers: []*tpb.ProviderRef{
					{
						Name: "envoy-json",
					},
				},
				Filter: &tpb.AccessLogging_Filter{
					Expression: "response.code >= 500",
				},
			},
		},
	}

		g.Expect(routes[0].ResponseHeadersToAdd[0].Header.Value).To(Equal("max-age=31536000; includeSubDomains; preload"))
	})

	t.Run("for direct response code", func(t *testing.T) {
		g := NewWithT(t)
		cg := core.NewConfigGenTest(t, core.TestOptions{})

		routes, err := route.BuildHTTPRoutesForVirtualService(node(cg), virtualServiceWithDirectResponse, serviceRegistry,

	// The hostname for the workload to be resolved by the ztunnel.
	// DNS queries are sent on-demand by default.
	// If the resolved DNS query has several endpoints, the request will be forwarded
	// to the first response.
	//
	// At a minimum, each workload must have either an address or hostname. For example,
	// a workload that backs a Kubernetes service will typically have only endpoints. A

	assert.EventuallyEqual(t, func() int {
		ep := GetEndpointsForPort(svc, ctl.Endpoints, 80)
		return len(ep)
	}, 2)

	ep := GetEndpointsForPort(svc, ctl.Endpoints, 80)
	if len(ep) != 2 {
		t.Fatalf("Invalid response for GetEndpoints %v", ep)
	}

	if ep[0].Address == "10.10.1.1" && ep[0].Network != "network1" {
		t.Fatalf("Endpoint with IP 10.10.1.1 is expected to be in network1 but get: %s", ep[0].Network)
	}

	ProxyRequest TriggerReason = "proxyrequest"
	// DependentResource describes a push triggered based on a proxy request for a
	// resource that depends on this resource (e.g. a CDS request triggers an EDS response as well)
	// This is mainly used in Delta for now.
	DependentResource TriggerReason = "depdendentresource"
	// NamespaceUpdate describes a push triggered by a Namespace change
	NamespaceUpdate TriggerReason = "namespace"