// health checks are enabled.
	// If this annotation is present, a WorkloadEntry with the condition Healthy=False or Healthy not set
	// should be treated as unhealthy and not sent to proxies
	WorkloadEntryHealthCheckAnnotation = "proxy.istio.io/health-checks-enabled"

	// ConditionHealthy defines a status field to declare if a WorkloadEntry is healthy or not
	ConditionHealthy = "Healthy"

import (
	networking "istio.io/api/networking/v1alpha3"
	"istio.io/istio/pkg/network"
)

// return the mesh network for the workload entry. Empty string if not found.
func (s *Controller) workloadEntryNetwork(wle *networking.WorkloadEntry) network.ID {
	if s == nil {
		return ""
	}
	// 1. first check the wle.Network
	if wle.Network != "" {
		return network.ID(wle.Network)
	}

	// 2. fall back to the passed in getNetworkCb func.

  location: MESH_INTERNAL
  workloadSelector:
    labels:
      app: random-{{$i}}

---
{{- end }}

---
{{- range $j := until .Instances }}
apiVersion: networking.istio.io/v1alpha3
kind: WorkloadEntry
metadata:
  name: random-{{$j}}
spec:
  serviceAccount: random
  address: 10.10.10.10
  labels:
    app: random-{{mod $j $.Services}}
---

apiVersion: networking.istio.io/v1alpha3
kind: WorkloadEntry
metadata:
  name: valid-workload-entry
spec:

apiVersion: networking.istio.io/v1
kind: WorkloadEntry
metadata:
  name: valid-workload-entry
spec:

apiVersion: networking.istio.io/v1beta1
kind: WorkloadEntry
metadata:
  name: valid-workload-entry
spec:

			},
		})
		makeIstioObject(t, store, workloadEntry)
		fx.WaitOrFail(t, "xds full")

		instances := []EndpointResponse{{
			Address: workloadEntry.Spec.(*networking.WorkloadEntry).Address,
			Port:    80,
		}}
		expectServiceEndpoints(t, fx, expectedSvc, 80, instances)

		fx.Clear()
		// Update the port
		newWorkloadEntry := workloadEntry.DeepCopy()
		spec := workloadEntry.Spec.(*networking.WorkloadEntry).DeepCopy()

			err := c.OnConnect(makeConn(proxy, time.Now()))
			assert.NoError(t, err)

			wle := store.Get(gvk.WorkloadEntry, we.Name, we.Namespace)
			if wle == nil {
				t.Fatalf("WorkloadEntry %s/%s must exist", we.Namespace, we.Name)
			}
			if diff := cmp.Diff(we.Annotations, wle.Annotations); diff != "" {
				t.Fatalf("WorkloadEntry should not have been changed: %v", diff)
			}
		})
	}
}

	// get previous status
	cfg := s.store.Get(gvk.WorkloadEntry, entryName, entryNs)
	if cfg == nil {
		return fmt.Errorf("failed to update health status for %v: WorkloadEntry %v not found", proxyID, entryNs)
	}
	// The workloadentry has reconnected to the other istiod
	if !s.cb.IsControllerOf(cfg) {
		return nil
	}

		autoCreate = true
	} else if features.WorkloadEntryHealthChecks && proxy.Metadata.WorkloadEntry != "" {
		// a non-empty value of the `WorkloadEntry` field indicates that proxy must correspond to the WorkloadEntry
		wle := c.store.Get(gvk.WorkloadEntry, proxy.Metadata.WorkloadEntry, proxy.Metadata.Namespace)
		if wle == nil {
			// either invalid proxy configuration or config propagation delay