return
	}
	log.Infof("cleaned up health-checked WorkloadEntry %s/%s periodic:%v", wle.Namespace, wle.Name, periodic)
}

// IsControllerOf implements state.StoreCallbacks.
func (c *Controller) IsControllerOf(wle *config.Config) bool {
	if wle == nil {
		return false
	}
	return wle.Annotations[annotation.IoIstioWorkloadController.Name] == c.instanceID
}

			ServiceAccount: spiffe.MustGenSpiffeURIForTrustDomain("cluster.local", selector.Name, "default"),
			TLSMode:        model.IstioMutualTLSModeLabel,
		},
	}

	wi3 := &model.WorkloadInstance{
		Name:      "another-name",
		Namespace: "dns-selector",
		Endpoint: &model.IstioEndpoint{
			Address:        "2.2.2.2",
			Labels:         map[string]string{"app": "dns-wle"},

func (s *Controller) workloadEntryNetwork(wle *networking.WorkloadEntry) network.ID {
	if s == nil {
		return ""
	}
	// 1. first check the wle.Network
	if wle.Network != "" {
		return network.ID(wle.Network)
	}

	// 2. fall back to the passed in getNetworkCb func.
	if s.networkIDCallback != nil {
		return s.networkIDCallback(wle.Address, wle.Labels)
	}
	return ""

		network := a.Network(wle.Spec.Address, wle.Labels).String()
		if wle.Spec.Network != "" {
			network = wle.Spec.Network
		}

		// enforce traversing waypoints
		policies = append(policies, implicitWaypointPolicies(ctx, Waypoints, waypoint, services)...)

		w := &workloadapi.Workload{
			Uid:                   a.generateWorkloadEntryUID(wle.Namespace, wle.Name),
			Name:                  wle.Name,

func (s *Store) DeleteHealthCondition(wle config.Config) error {
	wle = status.DeleteConfigCondition(wle, status.ConditionHealthy)
	// update the status
	_, err := s.store.UpdateStatus(wle)
	if err != nil && !errors.IsNotFound(err) {
		return fmt.Errorf("error while removing WorkloadEntry health status for %s/%s: %v", wle.Namespace, wle.Name, err)
	}
	return nil

func IsEligibleForHealthStatusUpdates(wle *config.Config) bool {
	if wle == nil {
		return false
	}
	_, annotated := wle.Annotations[status.WorkloadEntryHealthCheckAnnotation]
	return annotated
}

// HasHealthCondition returns true if a given WorkloadEntry has ConditionHealthy
// condition.
func HasHealthCondition(wle *config.Config) bool {
	if wle == nil {
		return false
	}

	wle := createWorkloadEntry("wl", selector.Name,
		&networking.WorkloadEntry{
			Address:        "2.2.2.2",
			Labels:         map[string]string{"app": "wle"},
			ServiceAccount: "default",
		})
	wle2 := createWorkloadEntry("wl2", selector.Name,
		&networking.WorkloadEntry{
			Address:        "3.3.3.3",
			Labels:         map[string]string{"app": "wle"},
			ServiceAccount: "default",
		})

	}
	networkID := s.workloadEntryNetwork(wle)
	locality := wle.Locality
	if locality == "" && len(wle.Labels[model.LocalityLabel]) > 0 {
		locality = model.GetLocalityLabel(wle.Labels[model.LocalityLabel])
	}
	labels := labelutil.AugmentLabels(wle.Labels, clusterID, locality, "", networkID)
	return &model.ServiceInstance{
		Endpoint: &model.IstioEndpoint{
			Address:         addr,

			sortServiceInstances(instances)
			sortServiceInstances(tt.out)

			if tt.wle.Locality != "" || tt.clusterID != "" || tt.wle.Network != "" {
				for _, serviceInstance := range tt.out {
					serviceInstance.Endpoint.Locality = model.Locality{
						Label:     tt.wle.Locality,
						ClusterID: tt.clusterID,

)

func getWorkloadServiceEntries(ses []config.Config, wle *networking.WorkloadEntry) map[types.NamespacedName]*config.Config {
	out := make(map[types.NamespacedName]*config.Config)
	for i, cfg := range ses {
		se := cfg.Spec.(*networking.ServiceEntry)
		if se.WorkloadSelector != nil && labels.Instance(se.WorkloadSelector.Labels).Match(wle.Labels) {
			out[cfg.NamespacedName()] = &ses[i]
		}
	}

	return out
}