// and all other ports on another. Additionally, we bind one port for communication between the custom image
	// container, and the regular Go server.
	if cfg.IsProxylessGRPC() && settings.CustomGRPCEchoImage != "" {
		var grpcPorts, otherPorts echoCommon.PortList
		for _, port := range containerPorts {
			if port.Protocol == protocol.GRPC {
				grpcPorts = append(grpcPorts, port)

			// Sidecar injection is enabled - it's not naked.
			return false
		}
	}
	// All subsets were annotated indicating no sidecar injection.
	return true
}

func (c Config) IsProxylessGRPC() bool {
	// TODO make these check if any subset has a matching annotation
	return len(c.Subsets) > 0 && c.Subsets[0].Annotations != nil && strings.HasPrefix(c.Subsets[0].Annotations[annotation.InjectTemplates.Name], "grpc-")

// HasL7 only allows traffic where there is some L7 processing occurring on the path
var HasL7 CombinationFilter = func(from echo.Instance, to echo.Instances) echo.Instances {
	if from.Config().HasSidecar() || from.Config().IsProxylessGRPC() {
		// client has l7
		return to
	}
	// otherwise give only serverside l7 endpoints
	return match.Matcher(func(instance echo.Instance) bool {
		return instance.Config().HasServiceAddressedWaypointProxy() ||

func newWorkloadManager(ctx resource.Context, cfg echo.Config, handler workloadHandler) (*workloadManager, error) {
	// Get the gRPC port and TLS settings.
	var grpcInstancePort int
	var tls *echoCommon.TLSSettings
	if cfg.IsProxylessGRPC() {
		grpcInstancePort = grpcMagicPort
	}
	if grpcInstancePort == 0 {
		if grpcPort, found := cfg.Ports.ForProtocol(protocol.GRPC); found {
			if grpcPort.TLS {
				tls = cfg.TLSSettings
			}

var NotHeadless = Not(Headless)

// ProxylessGRPC matches instances that are Pods with a SidecarInjectTemplate annotation equal to grpc.
var ProxylessGRPC Matcher = func(i echo.Instance) bool {
	return i.Config().IsProxylessGRPC()
}

// NotProxylessGRPC is equivalent to Not(ProxylessGRPC)
var NotProxylessGRPC = Not(ProxylessGRPC)

var TProxy Matcher = func(i echo.Instance) bool {
	return i.Config().IsTProxy()
}

	// See https://www.envoyproxy.io/docs/envoy/latest/api-docs/xds_protocol#deleting-resources.
	// This means if there are only removals, we will not respond.
	var logFiltered string
	if !req.Delta.IsEmpty() && !con.proxy.IsProxylessGrpc() {
		logFiltered = " filtered:" + strconv.Itoa(len(w.ResourceNames)-len(req.Delta.Subscribed))
		w = &model.WatchedResource{
			TypeUrl:       w.TypeUrl,
			ResourceNames: req.Delta.Subscribed.UnsortedList(),
		}

func (c *instance) aggregateResponses(opts echo.CallOptions) (echo.CallResult, error) {
	// TODO put this somewhere else, or require users explicitly set the protocol - quite hacky
	if c.Config().IsProxylessGRPC() && (opts.Scheme == scheme.GRPC || opts.Port.Name == "grpc" || opts.Port.Protocol == protocol.GRPC) {
		// for gRPC calls, use XDS resolver
		opts.Scheme = scheme.XDS
	}

	resps := make(echoClient.Responses, 0)

	h.Write(Separator)
	h.WriteString(string(b.nodeType))
	h.Write(Separator)
	h.WriteString(strconv.FormatBool(b.clusterLocal))
	h.Write(Separator)
	if b.proxy != nil {
		h.WriteString(strconv.FormatBool(b.proxy.IsProxylessGrpc()))
		h.Write(Separator)
		h.WriteString(strconv.FormatBool(bool(b.proxy.Metadata.DisableHBONESend)))
		h.Write(Separator)
	}
	h.WriteString(util.LocalityToString(b.locality))
	h.Write(Separator)

		defaultConfigs = append(defaultConfigs, proxylessGRPC)
	}

	if t.Settings().Ambient {
		if t.Settings().AmbientEverywhere {
			for i, config := range defaultConfigs {
				if !config.HasSidecar() && !config.IsProxylessGRPC() {
					scopes.Framework.Infof("adding waypoint to %s", config.NamespacedName())
					defaultConfigs[i].ServiceWaypointProxy = "shared"
					defaultConfigs[i].WorkloadWaypointProxy = "shared"
				}
			}

		panic(fmt.Sprintf("unexpectedly matched multiple virtual hosts for %v: %v", routeName, virtualHosts))
	}
	return virtualHosts
}

func SidecarIgnorePort(node *model.Proxy) bool {
	return !node.IsProxylessGrpc()
}

// generateVirtualHostDomains generates the set of domain matches for a service being accessed from
// a proxy node