func ConfigAffectsProxy(req *model.PushRequest, proxy *model.Proxy) bool {
	// Empty changes means "all" to get a backward compatibility.
	if len(req.ConfigsUpdated) == 0 {
		return true
	}
	if proxy.IsWaypointProxy() || proxy.IsZTunnel() {
		// Optimizations do not apply since scoping uses different mechanism
		// TODO: implement ambient aware scoping
		return true
	}

	for config := range req.ConfigsUpdated {

	}
}

func PolicyMatcherForProxy(proxy *Proxy) WorkloadPolicyMatcher {
	return WorkloadPolicyMatcher{
		Namespace:      proxy.ConfigNamespace,
		WorkloadLabels: proxy.Labels,
		IsWaypoint:     proxy.IsWaypointProxy(),
	}
}

func (p WorkloadPolicyMatcher) WithService(service *Service) WorkloadPolicyMatcher {
	if service == nil {
		return p
	}
	if service.Attributes.Namespace != p.Namespace {

			port:              port,
			clusterName:       model.BuildInboundSubsetKey(int(port.TargetPort)),
			bind:              actualWildcards[0],
			bindToPort:        bindToPort,
			hbone:             lb.node.IsWaypointProxy(),
		}
		// for inbound only generate a standalone listener when bindToPort=true
		if bindToPort && conflictWithReservedListener(lb.node, nil, cc.bind, int(port.TargetPort), port.Protocol) {

func (node *Proxy) InCluster(cluster cluster.ID) bool {
	return node == nil || identifier.IsSameOrEmpty(cluster.String(), node.Metadata.ClusterID.String())
}

// IsWaypointProxy returns true if the proxy is acting as a waypoint proxy in an ambient mesh.
func (node *Proxy) IsWaypointProxy() bool {
	return node.Type == Waypoint
}

// IsZTunnel returns true if the proxy is acting as a ztunnel in an ambient mesh.

	if len(names) == 0 {
		return nil
	}
	var out model.Resources
	mtlsPolicy := authn.NewMtlsPolicy(push, node.Metadata.Namespace, node.Labels, node.IsWaypointProxy())
	serviceInstancesByPort := map[uint32]model.ServiceTarget{}
	for _, si := range node.ServiceTargets {
		serviceInstancesByPort[si.Port.TargetPort] = si
	}

	for _, name := range names {

		return b.filterIstioEndpoint(ep)
	})

	localityEpMap := make(map[string]*LocalityEndpoints)
	for _, ep := range eps {
		mtlsEnabled := b.mtlsChecker.checkMtlsEnabled(ep, b.proxy.IsWaypointProxy())
		eep := buildEnvoyLbEndpoint(b, ep, mtlsEnabled)
		if eep == nil {
			continue
		}
		locLbEps, found := localityEpMap[ep.Locality.Label]
		if !found {
			locLbEps = &LocalityEndpoints{

		passThroughBindIPs: getPassthroughBindIPs(proxy.GetIPMode()),
		supportsIPv4:       proxy.SupportsIPv4(),
		supportsIPv6:       proxy.SupportsIPv6(),
		sendHbone:          features.EnableHBONESend || proxy.IsWaypointProxy(),
		locality:           proxy.Locality,
		proxyLabels:        proxy.Labels,
		proxyView:          proxy.GetView(),
		proxyIPAddresses:   proxy.IPAddresses,
		configNamespace:    proxy.ConfigNamespace,

	case model.Router:
		builder = configgen.buildGatewayListeners(builder)
	}

	builder.patchListeners()
	l := builder.getListeners()
	if features.EnableHBONESend && !builder.node.IsWaypointProxy() {
		l = append(l, buildConnectOriginateListener())
	}

	return l
}

func BuildListenerTLSContext(serverTLSSettings *networking.ServerTLSSettings,