# Delete a waypoint by name, which can obtain from istioctl waypoint list
  istioctl waypoint delete waypoint-name --namespace default

  # Delete several waypoints by name
  istioctl waypoint delete waypoint-name1 waypoint-name2 --namespace default

  # Delete all waypoints in a specific namespace
  istioctl waypoint delete --all --namespace default`,
		Args: func(cmd *cobra.Command, args []string) error {

If the target destination has a waypoint, we enforce that the request is coming from that waypoint. Otherwise, the request is rejected.
If there is no waypoint, ztunnel will enforce RBAC policies against the request.

If all checks pass, ztunnel will open a connection to the target. This will spoof the source IP (from `Forwarded` for waypoints, or the incoming IP otherwise).

}

func waypointName(wl *ZtunnelWorkload, services []*ZtunnelService) string {
	if wl.Waypoint == nil {
		return "None"
	}

	for _, svc := range services {
		if fmt.Sprintf("%s/%s", svc.Namespace, svc.Hostname) == wl.Waypoint.Destination {
			return svc.Name
		}
		for _, addr := range svc.Addresses {
			if addr == wl.Waypoint.Destination {
				return svc.Name
			}
		}
	}

				continue
			}
			healthyEndpoints++
		}
		endpoints := fmt.Sprintf("%d/%d", healthyEndpoints, allEndpoints)

		waypoint := serviceWaypointName(svc, zDump.Services)
		fmt.Fprintf(w, "%v\t%v\t%v\t%v\t%v\n",
			svc.Namespace, svc.Name, strings.Join(ips, ","), waypoint, endpoints)
	}
	return w.Flush()
}

// PrintServiceDump prints the relevant services in the config dump to the ConfigWriter stdout

                  "type": "prometheus",
                  "uid": "$datasource"
               },
               "expr": "sum (rate(istio_requests_total{reporter=~\"source|waypoint\",response_code!~\"5..\"}[$__rate_interval])) / sum (rate(istio_requests_total{reporter=~\"source|waypoint\"}[$__rate_interval]))"
            }
         ],
         "title": "Success Rate",
         "type": "stat"
      },
      {
         "datasource": {

bookinfo           bookinfo-productpage-istio-waypoint-5cdd6745d5-rc2gg 10.244.2.59 ambient-worker2       None                                TCP
bookinfo           details-v1-698d88b-dqrbr                             10.244.2.51 ambient-worker2       namespace-istio-waypoint            HBONE

        round(sum(rate(labels('istio_requests_total', { reporter: '~source|waypoint' }))))
      ),

      globalRequestSuccessRate: self.rawQuery(
        sum(rate(labels('istio_requests_total', { reporter: '~source|waypoint', response_code: '!~5..' }))) + ' / ' +
        sum(rate(labels('istio_requests_total', { reporter: '~source|waypoint' })))
      ),

      globalRequest4xx: self.rawQuery(

a `STRICT` `PeerAuthentication`, unauthenticated traffic will be rejected before it reaches the Waypoint proxy. If the effective policy is `PERMISSIVE` (the default), the ztunnel will open a vanilla TLS HBONE tunnel (NOTE: this is not mTLS) to the Waypoint proxy and forward the traffic over that connection without presenting a client certificate. Therefore, it is absolutely critical that the waypoint proxy not assume any identity from incoming connections, even if the ztunnel is hairpinning. In other...

	Subzone string `json:"subzone,omitempty"`
}

type ZtunnelWorkload struct {
	UID                   string            `json:"uid"`
	WorkloadIPs           []string          `json:"workloadIps"`
	Waypoint              *GatewayAddress   `json:"waypoint,omitempty"`
	NetworkGateway        *GatewayAddress   `json:"networkGateway,omitempty"`
	Protocol              string            `json:"protocol"`
	Name                  string            `json:"name"`

NAMESPACE POD NAME                       ADDRESS     NODE            WAYPOINT PROTOCOL
default   details-v1-698d88b-krdw7       10.244.2.55 ambient-worker2 None     HBONE
default   httpbin-7447985f87-t8hv7       10.244.1.40 ambient-worker  None     TCP
default   productpage-v1-675fc69cf-kkrm2 10.244.2.56 ambient-worker2 None     HBONE
default   ratings-v1-6484c4d9bb-8xc2r    10.244.2.57 ambient-worker2 None     HBONE