// add a "waypointed service" matcher
func WaypointService() Matcher {
	return func(i echo.Instance) bool {
		return ServiceAddressedWaypoint(i)
	}
}

func AmbientCaptured() Matcher {
	return func(i echo.Instance) bool {
		return i.Config().ZTunnelCaptured() && !i.Config().IsUncaptured()
	}
}

// RegularPod matches echos that don't meet any of the following criteria:
// - VM

---
`
	matchers := []match.Matcher{match.And(
		// No waypoint here, these are all via ingress which doesn't forward to waypoint
		match.NotWaypoint,
		match.Or(match.ServiceName(t.Apps.B.NamespacedName()), match.AmbientCaptured()),
	)}
	headersWithToken := map[string][]string{
		"Authorization": {"Bearer " + jwt.TokenIssuer1WithNestedClaims1},
	}
	headersWithInvalidToken := map[string][]string{