mergedPolicy.LoadBalancer = subsetPolicy.LoadBalancer
	}
	if subsetPolicy.Tls != nil || hasPortLevel {
		mergedPolicy.Tls = subsetPolicy.Tls
	}

	if subsetPolicy.Tunnel != nil {
		mergedPolicy.Tunnel = subsetPolicy.Tunnel
	}
	if subsetPolicy.ProxyProtocol != nil {
		mergedPolicy.ProxyProtocol = subsetPolicy.ProxyProtocol
	}
	return mergedPolicy
}

	}
	return
}

func validateTunnelSettings(tunnel *networking.TrafficPolicy_TunnelSettings) (errs error) {
	if tunnel == nil {
		return
	}
	if tunnel.Protocol != "" && tunnel.Protocol != "CONNECT" && tunnel.Protocol != "POST" {
		errs = appendErrors(errs, fmt.Errorf("tunnel protocol must be \"CONNECT\" or \"POST\""))
	}
	fqdnErr := agent.ValidateFQDN(tunnel.TargetHost)
	ipErr := agent.ValidateIPAddress(tunnel.TargetHost)

  string workload_name = 13;

  // If set, this indicates a workload expects to directly receive tunnel traffic.
  // In ztunnel, this means:
  // * Requests *from* this workload do not need to be tunneled if they already are tunneled by the tunnel_protocol.
  // * Requests *to* this workload, via the tunnel_protocol, do not need to be de-tunneled.
  bool native_tunnel = 14;

	listeners := []*listener.Listener{}
	// We create 3 listeners:
	// 1. Decapsulation CONNECT listener.
	// 2. IP dispatch listener, handling both VIPs and direct pod IPs.
	// 3. Encapsulation CONNECT listener, originating the tunnel
	wls, wps := findWaypointResources(lb.node, lb.push)

	listeners = append(listeners,
		lb.buildWaypointInboundConnectTerminate(),
		lb.buildWaypointInternal(wls, wps.orderedServices),

		var targetWaypoint *Waypoint
		if instancedWaypoint := fetchWaypointForInstance(ctx, Waypoints, p.ObjectMeta); instancedWaypoint != nil {
			// we're an instance of a waypoint, set inbound tunnel info
			appTunnel = &workloadapi.ApplicationTunnel{
				Protocol: instancedWaypoint.DefaultBinding.Protocol,
				Port:     instancedWaypoint.DefaultBinding.Port,
			}

	AmbientWaypointForTrafficTypeLabel = "istio.io/waypoint-for"

	// AmbientWaypointInboundBinding has the format `<protocol>` or `<protocol>/<port>`. If the waypoint is
	// captured by a zTunnel, the zTunnel  will send traffic to the specified port with tunnel information
	// such as source/destination addresses, identity and HBONE target host using the specified protocol.
	AmbientWaypointInboundBinding = "ambient.istio.io/waypoint-inbound-binding"

	// If set, this indicates a workload expects to directly receive tunnel traffic.
	// In ztunnel, this means:
	// * Requests *from* this workload do not need to be tunneled if they already are tunneled by the tunnel_protocol.
	// * Requests *to* this workload, via the tunnel_protocol, do not need to be de-tunneled.

local queries = (import './queries.libsonnet').queries({
  container: "istio-proxy",
  pod: "ztunnel-.*",
  component: "ztunnel",
  app: "ztunnel",
});

dashboard.new('Istio Ztunnel Dashboard')
+ g.dashboard.withPanels(
  grid.makeGrid([
    row.new('Process')
    + row.withPanels([
      panels.timeSeries.base('Ztunnel Versions', queries.istioBuild, 'Version number of each running instance'),

                  "type": "prometheus",
                  "uid": "$datasource"
               },
               "expr": "sum(istio_build{component=\"ztunnel\"}) by (tag)",
               "legendFormat": "Version ({{tag}})"
            }
         ],
         "title": "Ztunnel Versions",
         "type": "timeseries"
      },
      {
         "datasource": {
            "type": "datasource",
            "uid": "-- Mixed --"

  values:
    cni:
      ambient:
        # Some of the tests require DNS capture
        # For that, DNS capture must be enabled in the CNI
        # and DNS proxying must be enabled in ztunnel
        dnsCapture: true
    ztunnel:
      meshConfig:
        defaultConfig:
          proxyMetadata:
            ISTIO_META_DNS_CAPTURE: "true"
    meshConfig:
      defaultConfig:
        proxyMetadata: