{
  "workloads": {
    "network1/10.244.2.54": {
      "workloadIps": [
        "10.244.2.54"
      ],
      "waypoint": {
        "destination": "/10.96.65.117",
        "port": 15008
      },
      "protocol": "HBONE",
      "uid": "Kubernetes//Pod/bookinfo/ratings-v1-6484c4d9bb-mdxm5",
      "name": "ratings-v1-6484c4d9bb-mdxm5",
      "namespace": "bookinfo",
      "trustDomain": "cluster.local",

	Zone    string `json:"zone,omitempty"`
	Subzone string `json:"subzone,omitempty"`
}

type ZtunnelWorkload struct {
	UID                   string            `json:"uid"`
	WorkloadIPs           []string          `json:"workloadIps"`
	Waypoint              *GatewayAddress   `json:"waypoint,omitempty"`
	NetworkGateway        *GatewayAddress   `json:"networkGateway,omitempty"`
	Protocol              string            `json:"protocol"`

		address := strings.Join(wl.WorkloadIPs, ",")
		if len(address) == 0 {
			address = wl.Hostname
		}
		waypoint := waypointName(wl, zDump.Services)
		fmt.Fprintf(w, "%v\t%v\t%v\t%v\t%v\t%v\n",
			wl.Namespace, wl.Name, address, wl.Node, waypoint, wl.Protocol)

	}
	return w.Flush()
}

// PrintWorkloadDump prints the relevant workloads in the config dump to the ConfigWriter stdout

# This allows local testing by sending requests through the local ztunnel to other servers running on localhost.
workloads:
- uid: cluster1//v1/Pod/default/local
  name: local
  namespace: default
  serviceAccount: default
  workloadIps: ["127.0.0.1"]
  protocol: HBONE
  node: local
  network: ""
  services:
    "default/example.com":
      80: 8080
    "default/example2.com":

	d := c.ztunnelDump
	workloads := maps.Values(d.WorkloadState)
	workloads = slices.SortFunc(workloads, func(a, b WorkloadState) int {
		if r := cmp.Compare(a.Info.Namespace, b.Info.Namespace); r != 0 {
			return r
		}
		return cmp.Compare(a.Info.Namespace, b.Info.Namespace)
	})
	workloads = slices.FilterInPlace(workloads, func(state WorkloadState) bool {

## PeerAuthentication and ztunnel

Most of the API is fairly straight forward.
However, one interesting aspect is how these policies associate with workloads.
Istio's AuthorizationPolicy has label selectors.
However, we intentionally do not send those as part of the Workload API, in order to keep the size low.

The obvious solution to this is to put the list of selected workloads into the policy itself.
However, this means anytime a workload changes (often), we need to update the policy.

  istioctl ztunnel-config workloads --file ztunnel-config.json

  # Retrieve workload summary for a specific namespace
  istioctl ztunnel-config workloads <ztunnel-name[.namespace]> --workloads-namespace foo
`,
		Aliases: []string{"w", "workloads"},
		Args:    common.validateArgs,
		RunE: runConfigDump(ctx, common, func(cw *ztunnelDump.ConfigWriter) error {

type ConfigWriter struct {
	Stdout      io.Writer
	ztunnelDump *ZtunnelDump
	FullDump    []byte
}

type rawDump struct {
	Services      json.RawMessage          `json:"services"`
	Workloads     json.RawMessage          `json:"workloads"`
	Policies      json.RawMessage          `json:"policies"`
	Certificates  json.RawMessage          `json:"certificates"`
	WorkloadState map[string]WorkloadState `json:"workloadstate"`
}

    ]),
  ], panelHeight=5)
  + [

    panels.tables.requests('HTTP/gRPC Workloads', queries.httpWorkloads, 'Request information for HTTP services') + {
      gridPos+: {
        h: 16,
        w: 24,
        y: 10,
      },
    },
    panels.tables.tcpRequests('TCP Workloads', queries.tcpWorkloads, 'Bytes sent and recieived information for TCP services') + {
      gridPos+: {
        h: 16,