"stat_prefix": "connect_originate",
            "cluster": "connect_originate",
            "tunneling_config": {
             "hostname": "%DOWNSTREAM_LOCAL_ADDRESS%",
             "headers_to_add": [
              {
               "header": {
                "key": "baggage",

	}
	var headersToAdd []*core.HeaderValue
	additionalHeaders := maps.Keys(config.IncludeAdditionalHeadersInCheck)
	sort.Strings(additionalHeaders)
	for _, k := range additionalHeaders {
		headersToAdd = append(headersToAdd, &core.HeaderValue{
			Key:   k,
			Value: config.IncludeAdditionalHeadersInCheck[k],
		})
	}
	if len(headersToAdd) != 0 {

    filter: envoy.filters.http.rbac
    path:
    - key: istio_ext_authz_shadow_effective_policy_id
    value:
      stringMatch:
        prefix: istio-ext-authz
  httpService:
    authorizationRequest:
      headersToAdd:
      - key: x-header-1
        value: value-1
      - key: x-header-2
        value: value-2
    authorizationResponse:
      allowedClientHeaders:
        patterns:
        - exact: Set-cookie

    filter: envoy.filters.http.rbac
    path:
    - key: istio_ext_authz_shadow_effective_policy_id
    value:
      stringMatch:
        prefix: istio-ext-authz
  httpService:
    authorizationRequest:
      headersToAdd:
      - key: x-header-1
        value: value-1
      - key: x-header-2
        value: value-2
    authorizationResponse:
      allowedClientHeaders:
        patterns:
        - exact: Set-cookie

						ClusterSpecifier: &tcp.TcpProxy_Cluster{Cluster: ConnectOriginate},
						TunnelingConfig: &tcp.TcpProxy_TunnelingConfig{
							Hostname:     "%DOWNSTREAM_LOCAL_ADDRESS%",
							HeadersToAdd: headers,
						},
					}),
				},
			}},
		}},
	}
	return l
}

// buildWaypointHTTPFilters augments the common chain of Waypoint-bound HTTP filters.