// create the waypoint service
	s.addService(t, "waypoint-sa2",
		map[string]string{constants.ManagedGatewayLabel: constants.ManagedGatewayMeshControllerLabel},
		map[string]string{},
		[]int32{80}, map[string]string{constants.GatewayNameLabel: "waypoint-sa2"}, "10.0.0.3")
	s.assertEvent(t,
		s.podXdsName("waypoint-sa2-pod"),
		s.svcXdsName("waypoint-sa2"),
	)

	// WorkloadEntry not in policy
	s.addWorkloadEntries(t, "127.0.0.2", "name2", "sa2", map[string]string{"app": "not-a"})
	s.assertEvent(t, s.wleXdsName("name2"))
	assert.Equal(t,
		s.lookup(s.addrXdsName("127.0.0.2"))[0].GetWorkload().GetAuthorizationPolicies(),
		nil)

	// Add it to the policy by updating its selector
	s.addWorkloadEntries(t, "127.0.0.2", "name2", "sa2", map[string]string{"app": "a"})
	s.assertEvent(t, s.wleXdsName("name2"))

			expect:    false,
		},
		{
			name:      "added new sa",
			shardKey:  c1Key,
			endpoints: append(cluster1Endppoints, &IstioEndpoint{Address: "10.172.0.3", ServiceAccount: "sa2"}),
			expect:    true,
		},
		{
			name:     "updated endpoints address",
			shardKey: c1Key,
			endpoints: []*IstioEndpoint{
				{Address: "10.172.0.5", ServiceAccount: "sa1"},

			objs:       []runtime.Object{kubeSystemNamespace, sa2, saSecret, saSecret2},
			secretName: saSecret.Name,
			name:       "cluster-foo",
			want:       "cal-want",
		},
		{
			testName:        "fail when non-existing secret name provided",
			objs:            []runtime.Object{kubeSystemNamespace, sa2, saSecret, saSecret2},
			secretName:      "nonexistingSecret",

	pod1 := generatePod("127.0.0.1", "pod1", testNS, "sa1", "node1", map[string]string{"app": "a"}, nil)
	pc.CreateOrUpdateStatus(pod1)
	fx.WaitOrFail(t, "xds")

	pod2 := generatePod("127.0.0.2", "pod2", testNS, "sa2", "node1", map[string]string{"app": "a"}, nil)
	pc.CreateOrUpdateStatus(pod2)
	fx.WaitOrFail(t, "xds")

	sc.CreateOrUpdate(generateService("svc1", testNS, map[string]string{}, // labels

			},
			shouldEq: true,
			name:     "matching service accounts",
		},
		{
			first: &Service{
				ServiceAccounts: []string{"sa1"},
			},
			other: &Service{
				ServiceAccounts: []string{"sa2"},
			},
			shouldEq: false,
			name:     "different service accounts",
		},
		{
			first: &Service{
				ClusterVIPs: AddressMap{
					Addresses: map[cluster.ID][]string{

		}
		index.shardsBySvc[string(svc.Hostname)][svc.Attributes.Namespace] = &EndpointShards{
			ServiceAccounts: sets.New("spiffe://cluster.local/ns/def/sa/sa1", "spiffe://cluster.local/ns/def/sa/sa2"),
		}
	}
	b.ResetTimer()
	for n := 0; n < b.N; n++ {
		ps.initServiceAccounts(env, services)
	}

							{
								Source: &security_beta.Source{
									Principals: []string{"sa1"},
								},
							},
							{
								Source: &security_beta.Source{
									Principals: []string{"sa2"},
								},
							},
						},
						To: []*security_beta.Rule_To{
							{
								Operation: &security_beta.Operation{
									Methods: []string{"GET"},
								},
							},
							{