s.assertEvent(t, s.podXdsName("pod2"))

	s.addWaypoint(t, "10.0.0.1", "waypoint-sa1", "", false)
	s.addWaypoint(t, "10.0.0.2", "waypoint-sa2", constants.WorkloadTraffic, true)
	s.assertEvent(t, s.podXdsName("pod2"))

	// make waypoint-sa1 ready
	s.addWaypoint(t, "10.0.0.1", "waypoint-sa1", constants.WorkloadTraffic, true)
	// if waypoint-sa1 was configured when not ready "pod2" assertions should skip the "pod1" xds event and this should fail

	s := newAmbientTestServer(t, testC, testNW)
	s.addWorkloadEntries(t, "", "emptyaddr1", "sa1", map[string]string{"app": "a"})
	s.assertEvent(t, s.wleXdsName("emptyaddr1"))
	s.assertWorkloads(t, "", workloadapi.WorkloadStatus_HEALTHY, "emptyaddr1")

	s.addWorkloadEntries(t, "", "emptyaddr2", "sa1", map[string]string{"app": "a"})
	s.assertEvent(t, s.wleXdsName("emptyaddr2"))

			return nil
		}, retry.Timeout(time.Second*5))
	}

	pc := clienttest.NewWriter[*corev1.Pod](t, s.client)
	sc := clienttest.NewWriter[*corev1.Service](t, s.client)
	pod1 := generatePod("127.0.0.1", "pod1", testNS, "sa1", "node1", map[string]string{"app": "a"}, nil)
	pc.CreateOrUpdateStatus(pod1)
	fx.WaitOrFail(t, "xds")

	pod2 := generatePod("127.0.0.2", "pod2", testNS, "sa2", "node1", map[string]string{"app": "a"}, nil)

		{
			serviceAccount: api.ServiceAccount{
				ObjectMeta: metav1.ObjectMeta{
					Name:              "sa1",
					CreationTimestamp: metav1.Time{Time: time.Now().Add(1.9e9)},
				},
				Secrets: []api.ObjectReference{},
			},
			// Columns: Name, (Num) Secrets, Age
			expected: []metav1.TableRow{{Cells: []interface{}{"sa1", int64(0), "0s"}}},
		},
		// Basic service account with two secrets.
		{

			index.shardsBySvc[string(svc.Hostname)] = map[string]*EndpointShards{}
		}
		index.shardsBySvc[string(svc.Hostname)][svc.Attributes.Namespace] = &EndpointShards{
			ServiceAccounts: sets.New("spiffe://cluster.local/ns/def/sa/sa1", "spiffe://cluster.local/ns/def/sa/sa2"),
		}
	}
	b.ResetTimer()
	for n := 0; n < b.N; n++ {
		ps.initServiceAccounts(env, services)
	}

						"version": "v1",
					},
				},
				Rules: []*security_beta.Rule{
					{
						From: []*security_beta.Rule_From{
							{
								Source: &security_beta.Source{
									Principals: []string{"sa1"},
								},
							},
							{
								Source: &security_beta.Source{
									Principals: []string{"sa2"},
								},
							},
						},
						To: []*security_beta.Rule_To{
							{