# Delete a waypoint by name, which can obtain from istioctl waypoint list
  istioctl waypoint delete waypoint-name --namespace default

  # Delete several waypoints by name
  istioctl waypoint delete waypoint-name1 waypoint-name2 --namespace default

  # Delete all waypoints in a specific namespace
  istioctl waypoint delete --all --namespace default`,
		Args: func(cmd *cobra.Command, args []string) error {

}

func waypointName(wl *ZtunnelWorkload, services []*ZtunnelService) string {
	if wl.Waypoint == nil {
		return "None"
	}

	for _, svc := range services {
		if fmt.Sprintf("%s/%s", svc.Namespace, svc.Hostname) == wl.Waypoint.Destination {
			return svc.Name
		}
		for _, addr := range svc.Addresses {
			if addr == wl.Waypoint.Destination {
				return svc.Name
			}
		}
	}

                  "type": "prometheus",
                  "uid": "$datasource"
               },
               "expr": "sum (rate(istio_requests_total{reporter=~\"source|waypoint\",response_code!~\"5..\"}[$__rate_interval])) / sum (rate(istio_requests_total{reporter=~\"source|waypoint\"}[$__rate_interval]))"
            }
         ],
         "title": "Success Rate",
         "type": "stat"
      },
      {
         "datasource": {

bookinfo           bookinfo-productpage-istio-waypoint-5cdd6745d5-rc2gg 10.244.2.59 ambient-worker2       None                                TCP
bookinfo           details-v1-698d88b-dqrbr                             10.244.2.51 ambient-worker2       namespace-istio-waypoint            HBONE

        round(sum(rate(labels('istio_requests_total', { reporter: '~source|waypoint' }))))
      ),

      globalRequestSuccessRate: self.rawQuery(
        sum(rate(labels('istio_requests_total', { reporter: '~source|waypoint', response_code: '!~5..' }))) + ' / ' +
        sum(rate(labels('istio_requests_total', { reporter: '~source|waypoint' })))
      ),

      globalRequest4xx: self.rawQuery(

      "uid": "Kubernetes//Pod/bookinfo/namespace-istio-waypoint-d94944bf6-z89g2",
      "name": "namespace-istio-waypoint-d94944bf6-z89g2",
      "namespace": "bookinfo",
      "trustDomain": "cluster.local",
      "serviceAccount": "namespace-istio-waypoint",
      "workloadName": "namespace-istio-waypoint",
      "workloadType": "deployment",
      "canonicalName": "namespace-istio-waypoint",
      "canonicalRevision": "latest",

a `STRICT` `PeerAuthentication`, unauthenticated traffic will be rejected before it reaches the Waypoint proxy. If the effective policy is `PERMISSIVE` (the default), the ztunnel will open a vanilla TLS HBONE tunnel (NOTE: this is not mTLS) to the Waypoint proxy and forward the traffic over that connection without presenting a client certificate. Therefore, it is absolutely critical that the waypoint proxy not assume any identity from incoming connections, even if the ztunnel is hairpinning. In other...

If the target destination has a waypoint, we enforce that the request is coming from that waypoint. Otherwise, the request is rejected.
If there is no waypoint, ztunnel will enforce RBAC policies against the request.

If all checks pass, ztunnel will open a connection to the target. This will spoof the source IP (from `Forwarded` for waypoints, or the incoming IP otherwise).

NAMESPACE     NAME         REVISION     PROGRAMMED
default       waypoint     default      True

	Subzone string `json:"subzone,omitempty"`
}

type ZtunnelWorkload struct {
	UID                   string            `json:"uid"`
	WorkloadIPs           []string          `json:"workloadIps"`
	Waypoint              *GatewayAddress   `json:"waypoint,omitempty"`
	NetworkGateway        *GatewayAddress   `json:"networkGateway,omitempty"`
	Protocol              string            `json:"protocol"`
	Name                  string            `json:"name"`