return "None"
	}

	if svc, ok := services[wl.Waypoint.Destination]; ok {
		return svc.Name
	}

	return "NA" // Shouldn't normally reach here
}

func serviceWaypointName(svc *ZtunnelService, services map[string]*ZtunnelService) string {
	if svc.Waypoint == nil {
		return "None"
	}

	if svc, ok := services[svc.Waypoint.Destination]; ok {
		return svc.Name
	}

		"The duration to wait before failing")
	cmd.PersistentFlags().StringVar(&o.XDSSAN, "authority", viper.GetString("AUTHORITY"),
		"XDS Subject Alternative Name (for example istiod.istio-system.svc)")
	cmd.PersistentFlags().BoolVar(&o.InsecureSkipVerify, "insecure", viper.GetBool("INSECURE"),
		"Skip server certificate and domain verification. (NOT SECURE!)")

	}

	return &retval, nil
}

func makeSan(istioNamespace, revision string) string {
	if revision == "" {
		return fmt.Sprintf("istiod.%s.svc", istioNamespace)
	}
	return fmt.Sprintf("istiod-%s.%s.svc", revision, istioNamespace)
}

// AllRequestAndProcessXds returns all XDS responses from 1 central or 1..N K8s cluster-based XDS servers
// nolint: lll

				// The reason we need to skip this is for a special
				// usecase where we need to make sure that
				// minio.<namespace>.svc.<cluster_domain> is ignored
				// by the bucketDNS style to ensure that path style
				// is available and honored at this domain.
				//
				// All other `<bucket>.<namespace>.svc.<cluster_domain>`
				// makes sure that buckets are routed through this matcher
				// to match for `<bucket>`

		if err != nil {
			return errSRBackendIssue(err)
		}

		for user, acc := range serviceAccounts {
			if user == siteReplicatorSvcAcc {
				// skip the site replicate svc account as it is
				// already replicated.
				continue
			}

			claims, err := globalIAMSys.GetClaimsForSvcAcc(ctx, acc.Credentials.AccessKey)
			if err != nil {
				return errSRBackendIssue(err)

		store.loadUser(ctx, accessKey, svcUser, cache.iamUsersMap)
		var svc UserIdentity
		svc, found = cache.iamUsersMap[accessKey]
		if found {
			// Load parent user and mapped policies.
			if store.getUsersSysType() == MinIOUsersSysType {
				store.loadUser(ctx, svc.Credentials.ParentUser, regUser, cache.iamUsersMap)
				store.loadMappedPolicyWithRetry(ctx, svc.Credentials.ParentUser, regUser, false, cache.iamUserPolicyMap, 3)

	}
	userAdmClient.SetCustomTransport(s.TestSuiteCommon.client.Transport)

	// Create svc acc
	cr := c.mustCreateSvcAccount(ctx, value.AccessKeyID, userAdmClient)

	// 1. Check that svc account appears in listing
	c.assertSvcAccAppearsInListing(ctx, userAdmClient, value.AccessKeyID, cr.AccessKey)

	// 2. Check that svc account info can be queried

	svcs, err := cli.Kube().CoreV1().Services(metav1.NamespaceAll).List(context.Background(), metav1.ListOptions{})
	if err != nil {
		return err
	}
	for _, svc := range svcs.Items {
		if svc.Spec.Type != corev1.ServiceTypeExternalName {
			continue
		}
		res := ObjectToInstance(&svc)
		messages.Add(msg.NewUpdateIncompatibility(res,
			"ENABLE_EXTERNAL_NAME_ALIAS", "1.20",

	}

	if isRevisioned(revision) {
		overrides["CA_ADDR"] = IstiodAddr(istioNamespace, revision)
	}
	if len(internalIP) > 0 {
		overrides["ISTIO_SVC_IP"] = internalIP
	} else if len(externalIP) > 0 {
		overrides["ISTIO_SVC_IP"] = externalIP
		overrides["REWRITE_PROBE_LEGACY_LOCALHOST_DESTINATION"] = "true"
	}

  # Retrieve full certificate dump of workloads for a given Ztunnel instance.
  istioctl x ztunnel-config services <ztunnel-name[.namespace]> -o json
`,
		Aliases: []string{"services", "s", "svc"},
		Args:    common.validateArgs,
		RunE: runConfigDump(ctx, common, func(cw *ztunnelDump.ConfigWriter) error {
			filter := ztunnelDump.ServiceFilter{
				Namespace: serviceNamespace,
			}