cluster/agent                                                       cluster/agent                         -        -          -               STATIC     
cluster/inbound-vip|8000|http|httpbin.default.svc.cluster.local     httpbin.default.svc.cluster.local     8000     http       inbound-vip     EDS        
cluster/prometheus_stats                                            cluster/prometheus_stats              -        -          -               STATIC     

            "name": "inbound-vip|9080|http|ratings.default.svc.cluster.local",
            "type": "EDS",
            "eds_cluster_config": {
              "eds_config": {
                "ads": {},
                "initial_fetch_timeout": "0s",
                "resource_api_version": "V3"
              },
              "service_name": "inbound-vip|9080|http|ratings.default.svc.cluster.local"
            },
            "transport_socket": {

				return err
			}

			matchingServices := make([]corev1.Service, 0, len(svcs.Items))
			for _, svc := range svcs.Items {
				if len(svc.Spec.Selector) > 0 {
					svcSelector := klabels.SelectorFromSet(svc.Spec.Selector)
					if svcSelector.Matches(podLabels) {
						matchingServices = append(matchingServices, svc)
					}
				}
			}
			// Validate Istio's "Service association" requirement

	})
	fmt.Fprintln(w, "NAMESPACE\tSERVICE NAME\tSERVICE VIP\tWAYPOINT\tENDPOINTS")

	for _, svc := range svcs {
		ips := []string{}
		for _, addr := range svc.Addresses {
			_, ip, _ := strings.Cut(addr, "/")
			ips = append(ips, ip)
		}
		allEndpoints := len(svc.Endpoints)
		healthyEndpoints := 0
		for _, ep := range svc.Endpoints {
			w, f := workloadsByUID[ep.WorkloadUID]
			if !f {
				continue
			}

	// 1.2 Check that svc account appears in listing
	c.assertSvcAccAppearsInListing(ctx, s.adm, accessKey, cr.AccessKey)

	// 1.3 Check that svc account info can be queried
	c.assertSvcAccInfoQueryable(ctx, s.adm, accessKey, cr.AccessKey, false)

	// 2. Check that svc account can access the bucket
	c.assertSvcAccS3Access(ctx, s, cr, bucket)

	// 3. Check that svc account can restrict the policy, and that the

                                        "name": "inbound-vip|80||sleep.default.svc.cluster.local-http",
                                        "typed_config": {
                                          "@type": "type.googleapis.com/google.protobuf.StringValue",
                                          "value": "inbound-vip|80||sleep.default.svc.cluster.local-http"
                                        }

		return "None"
	}

	for _, svc := range services {
		if fmt.Sprintf("%s/%s", svc.Namespace, svc.Hostname) == wl.Waypoint.Destination {
			return svc.Name
		}
		for _, addr := range svc.Addresses {
			if addr == wl.Waypoint.Destination {
				return svc.Name
			}
		}
	}

	return "NA" // Shouldn't normally reach here
}

func serviceWaypointName(svc *ZtunnelService, services []*ZtunnelService) string {

./mc admin user svcacct info minio1 testsvc
if [ $? -ne 0 ]; then
	echo "svc account not mirrored, exiting.."
	exit_1
fi

./mc admin user svcacct info minio2 testsvc
if [ $? -ne 0 ]; then
	echo "svc account not mirrored, exiting.."
	exit_1
fi

./mc admin user svcacct info minio3 testsvc
if [ $? -ne 0 ]; then
	echo "svc account not mirrored, exiting.."
	exit_1
fi

if [ $? -ne 0 ]; then
	echo "adding svc account failed, exiting.."
	exit_1
fi

sleep 10

./mc admin user svcacct info minio1 testsvc
if [ $? -ne 0 ]; then
	echo "svc account not mirrored, exiting.."
	exit_1
fi

./mc admin user svcacct info minio2 testsvc
if [ $? -ne 0 ]; then
	echo "svc account not mirrored, exiting.."
	exit_1
fi

          "address": "/10.244.2.8",
          "port": {
            "443": 8443
          }
        }
      },
      "subjectAltNames": []
    },
    "/10.96.198.255": {
      "name": "productpage",
      "namespace": "default",
      "hostname": "productpage.default.svc.cluster.local",
      "vips": [
        "/10.96.198.255"