s.svcXdsName("waypoint-sa2"),
	)
	s.assertAddresses(t, "", "pod1", "pod2", "pod3", "pod4", "waypoint-ns", "waypoint-ns-pod", "waypoint-sa2-pod", "waypoint-sa2")

	// We should now see the waypoint service IP
	assert.Equal(t,
		s.lookup(s.addrXdsName("127.0.0.3"))[0].Address.GetWorkload().Waypoint.GetAddress().Address,
		netip.MustParseAddr("10.0.0.2").AsSlice())

	assert.Equal(t,

			"waypoint",
			"apply",
			"--namespace",
			apps.Namespace.Name(),
			"--name", "captured-waypoint",
			"--wait",
		})
		t.Cleanup(func() {
			istioctl.NewOrFail(t, t, istioctl.Config{}).InvokeOrFail(t, []string{
				"waypoint",
				"delete",
				"--namespace",
				apps.Namespace.Name(),
				"captured-waypoint",
			})
		})

{
  "configs": [
    {
      "@type": "type.googleapis.com/envoy.admin.v3.BootstrapConfigDump",
      "bootstrap": {
        "node": {
          "id": "waypoint~192.168.252.229~httpbin-istio-waypoint-58f646c5ff-dbfkz.default~default.svc.cluster.local",
          "metadata": {
            "ISTIO_PROXY_SHA": "ee85c5f28702f00621aed895915fca565796b9e4",
            "ISTIO_VERSION": "1.21.0-1226",
            "metadata": {
              "build.type": "RELEASE",

	// Waypoint is the waypoint proxy for this service. When set, all incoming requests must go
	// through the waypoint.
	Waypoint *GatewayAddress `protobuf:"bytes,7,opt,name=waypoint,proto3" json:"waypoint,omitempty"`
	// Load balancing policy for selecting endpoints.
	// Note: this applies only to connecting directly to the workload; when waypoints are used, the waypoint's load_balancing

                            },
                            {
                              "tag": "istio.canonical_service",
                              "literal": {
                                "value": "namespace-istio-waypoint"
                              }
                            },
                            {
                              "tag": "istio.cluster_id",
                              "literal": {

	http3Only bool

	class istionetworking.ListenerClass
	port  int
	hbone bool

	// Waypoint-specific modifications in HCM
	isWaypoint bool

	// allow service attached policy for to-service chains
	// currently only used for waypoints
	policySvc *model.Service
}

// filterChainOpts describes a filter chain: a set of filters with the same TLS context

// Used when calculating the workloads which should be configured for a specific waypoint proxy
func (ps *PushContext) WorkloadsForWaypoint(key WaypointKey) []WorkloadInfo {
	return ps.ambientIndex.WorkloadsForWaypoint(key)
}

// ServicesForWaypoint returns all services associated with a given waypoint identified by it's WaypointKey

                            },
                            {
                              "tag": "istio.canonical_service",
                              "literal": {
                                "value": "namespace-istio-waypoint"
                              }
                            },
                            {
                              "tag": "istio.cluster_id",
                              "literal": {

          imagePullSecrets:
            {{- range .Values.global.imagePullSecrets }}
            - name: {{ . }}
            {{- end }}
          {{- end }}
      waypoint: |
        apiVersion: v1
        kind: ServiceAccount
        metadata:
          name: {{.ServiceAccount | quote}}
          namespace: {{.Namespace | quote}}
          annotations:

      {{- if .Values.global.imagePullSecrets }}
      imagePullSecrets:
        {{- range .Values.global.imagePullSecrets }}
        - name: {{ . }}
        {{- end }}
      {{- end }}
  waypoint: |
    apiVersion: v1
    kind: ServiceAccount
    metadata:
      name: {{.ServiceAccount | quote}}
      namespace: {{.Namespace | quote}}
      annotations: