}},
				}},
			},
		},
		expectedErrors: field.ErrorList{
			field.Required(field.NewPath("spec").Child("rules").Index(0).Child("subjects").Index(0).Child("serviceAccount"), "serviceAccount is required when subject kind is 'ServiceAccount'"),
			field.Forbidden(field.NewPath("spec").Child("rules").Index(0).Child("subjects").Index(0).Child("user"), "user is forbidden when subject kind is not 'User'"),

		&networking.WorkloadEntry{
			Address:        "2.2.2.2",
			Labels:         map[string]string{"app": "wle"},
			ServiceAccount: "default",
		})
	wle2 := createWorkloadEntry("wl2", selector.Name,
		&networking.WorkloadEntry{
			Address:        "3.3.3.3",
			Labels:         map[string]string{"app": "wle"},
			ServiceAccount: "default",
		})
	wle3 := createWorkloadEntry("wl3", selector.Name,
		&networking.WorkloadEntry{

			nil,
			[]string{"spiffe://foo/serviceaccount/1"},
			"foo.com",
			&model.Proxy{Metadata: &model.NodeMetadata{}},
			true, false, model.MTLSStrict,
			&networking.ClientTLSSettings{
				Mode:            networking.ClientTLSSettings_ISTIO_MUTUAL,
				SubjectAltNames: []string{"spiffe://foo/serviceaccount/1"},
				Sni:             "foo.com",
			},
			autoDetected,
		},

        {{- range .Values.global.imagePullSecrets }}
        - name: {{ . }}
        {{- end }}
      {{- end }}
  waypoint: |
    apiVersion: v1
    kind: ServiceAccount
    metadata:
      name: {{.ServiceAccount | quote}}
      namespace: {{.Namespace | quote}}
      annotations:

        {{- range .Values.global.imagePullSecrets }}
        - name: {{ . }}
        {{- end }}
      {{- end }}
  waypoint: |
    apiVersion: v1
    kind: ServiceAccount
    metadata:
      name: {{.ServiceAccount | quote}}
      namespace: {{.Namespace | quote}}
      annotations:

        {{- range .Values.global.imagePullSecrets }}
        - name: {{ . }}
        {{- end }}
      {{- end }}
  waypoint: |
    apiVersion: v1
    kind: ServiceAccount
    metadata:
      name: {{.ServiceAccount | quote}}
      namespace: {{.Namespace | quote}}
      annotations:

        {{- range .Values.global.imagePullSecrets }}
        - name: {{ . }}
        {{- end }}
      {{- end }}
  waypoint: |
    apiVersion: v1
    kind: ServiceAccount
    metadata:
      name: {{.ServiceAccount | quote}}
      namespace: {{.Namespace | quote}}
      annotations:

        {{- range .Values.global.imagePullSecrets }}
        - name: {{ . }}
        {{- end }}
      {{- end }}
  waypoint: |
    apiVersion: v1
    kind: ServiceAccount
    metadata:
      name: {{.ServiceAccount | quote}}
      namespace: {{.Namespace | quote}}
      annotations:

        {{- range .Values.global.imagePullSecrets }}
        - name: {{ . }}
        {{- end }}
      {{- end }}
  waypoint: |
    apiVersion: v1
    kind: ServiceAccount
    metadata:
      name: {{.ServiceAccount | quote}}
      namespace: {{.Namespace | quote}}
      annotations:

        {{- range .Values.global.imagePullSecrets }}
        - name: {{ . }}
        {{- end }}
      {{- end }}
  waypoint: |
    apiVersion: v1
    kind: ServiceAccount
    metadata:
      name: {{.ServiceAccount | quote}}
      namespace: {{.Namespace | quote}}
      annotations: