Namespace      string
	WorkloadLabels labels.Instance
	IsWaypoint     bool
	Service        string
}

func PolicyMatcherFor(workloadNamespace string, labels labels.Instance, isWaypoint bool) WorkloadPolicyMatcher {
	return WorkloadPolicyMatcher{
		Namespace:      workloadNamespace,
		WorkloadLabels: labels,
		IsWaypoint:     isWaypoint,
	}
}

func PolicyMatcherForProxy(proxy *Proxy) WorkloadPolicyMatcher {

		},
		Status: gateway.GatewayStatus{
			Conditions: conditions,
		},
	}
}

func makeGatewayWithRevision(name, namespace string, programmed, isWaypoint bool, rev string) *gateway.Gateway {
	gw := makeGateway(name, namespace, programmed, isWaypoint)
	if gw.Labels == nil {
		gw.Labels = make(map[string]string)
	}
	gw.Labels[label.IoIstioRev.Name] = rev
	return gw

		Namespace: "default",
		WorkloadLabels: labels.Instance{
			"app": "my-app",
		},
		IsWaypoint: false,
	}
	sampleGateway := WorkloadPolicyMatcher{
		Namespace: "default",
		WorkloadLabels: labels.Instance{
			constants.GatewayNameLabel: "sample-gateway",
		},
		IsWaypoint: false,
	}
	sampleWaypoint := WorkloadPolicyMatcher{
		Namespace: "default",
		WorkloadLabels: labels.Instance{

func NewMtlsPolicy(push *model.PushContext, namespace string, labels labels.Instance, isWaypoint bool) MtlsPolicy {
	return newPolicyApplier(
		push.AuthnPolicies.GetRootNamespace(),
		nil,
		push.AuthnPolicies.GetPeerAuthenticationsForWorkload(model.PolicyMatcherFor(namespace, labels, isWaypoint)),
		push,
	)

// on the DR, original endpoint TLSMode (based on injection of sidecar), and PeerAuthentication settings.
func (c *mtlsChecker) checkMtlsEnabled(ep *model.IstioEndpoint, isWaypoint bool) bool {
	if drMode := c.destinationRule; drMode != nil {
		return *drMode == networkingapi.ClientTLSSettings_ISTIO_MUTUAL
	}

		workloadNamespace      string
		workloadLabels         labels.Instance
		wantRequestAuthn       []*config.Config
		wantPeerAuthn          []*config.Config
		wantNamespaceMutualTLS MutualTLSMode
		isWaypoint             bool
	}{
		{
			name:              "Empty workload labels in foo",
			workloadNamespace: "foo",
			workloadLabels:    nil,
			wantRequestAuthn: []*config.Config{
				{
					Meta: config.Meta{

	reqIDExtensionCtx := configureTracing(lb.push, lb.node, connectionManager, httpOpts.class, httpOpts.policySvc)

	filters := []*hcm.HttpFilter{}
	if !httpOpts.isWaypoint {
		wasm := lb.push.WasmPluginsByListenerInfo(lb.node, model.WasmPluginListenerInfo{
			Port:  httpOpts.port,
			Class: httpOpts.class,
		}, model.WasmPluginTypeHTTP)

			want: false,
		},
	}

	for _, tc := range cases {
		t.Run(tc.desc, func(t *testing.T) {
			opts := WorkloadPolicyMatcher{
				Namespace:      "ns",
				WorkloadLabels: tc.proxyLabels,
				IsWaypoint:     false,
			}
			got := tc.wasmPlugin.MatchListener(opts, tc.listenerInfo)
			if tc.want != got {
				t.Errorf("MatchListener got %v want %v", got, tc.want)
			}
		})
	}

				{
					Name:      "authz-2",
					Namespace: "bar",
					Spec:      policy,
				},
			},
		},
		{
			name: "waypoint service attached",
			selectionOpts: WorkloadPolicyMatcher{
				IsWaypoint: true,
				Service:    "foo-svc",
				Namespace:  "foo",
				WorkloadLabels: labels.Instance{
					constants.GatewayNameLabel: "foo-waypoint",
					// labels match in selector policy but ignore them for waypoint

}

func (c Config) IsUncaptured() bool {
	// TODO this can be more robust to not require labeling initial echo config (check namespace + isWaypoint + not sidecar)
	return len(c.Subsets) > 0 && c.Subsets[0].Labels != nil && c.Subsets[0].Labels[constants.DataplaneModeLabel] == constants.DataplaneModeNone
}

func (c Config) HasProxyCapabilities() bool {