d := c.ztunnelDump
	workloads := maps.Values(d.WorkloadState)
	workloads = slices.SortFunc(workloads, func(a, b WorkloadState) int {
		if r := cmp.Compare(a.Info.Namespace, b.Info.Namespace); r != 0 {
			return r
		}
		return cmp.Compare(a.Info.Namespace, b.Info.Namespace)
	})
	workloads = slices.FilterInPlace(workloads, func(state WorkloadState) bool {

	Workloads     json.RawMessage          `json:"workloads"`
	Policies      json.RawMessage          `json:"policies"`
	Certificates  json.RawMessage          `json:"certificates"`
	WorkloadState map[string]WorkloadState `json:"workloadstate"`
}

// Prime loads the config dump into the writer ready for printing
func (c *ConfigWriter) Prime(b []byte) error {
	zDump := &ZtunnelDump{}
	rawDump := &rawDump{}

	Services      []*ZtunnelService        `json:"services"`
	Policies      []*ZtunnelPolicy         `json:"policies"`
	Certificates  []*CertsDump             `json:"certificates"`
	WorkloadState map[string]WorkloadState `json:"workloadState"`
}

type CertsDump struct {
	Identity  string  `json:"identity"`
	State     string  `json:"state"`
	CertChain []*Cert `json:"certChain"`
}

type Cert struct {

		"HEALTHY":   0,
		"UNHEALTHY": 1,
	}
)

func (x WorkloadStatus) Enum() *WorkloadStatus {
	p := new(WorkloadStatus)
	*p = x
	return p
}

func (x WorkloadStatus) String() string {
	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
}

func (WorkloadStatus) Descriptor() protoreflect.EnumDescriptor {
	return file_workloadapi_workload_proto_enumTypes[0].Descriptor()

  // are returned out of band.
  // Authorization policies are only valid for workloads with `addresses` rather than `hostname`.
  repeated string authorization_policies = 16;

  WorkloadStatus status = 17;

  // The cluster ID that the workload instance belongs to
  string cluster_id = 18;

  // The Locality defines information about where a workload is geographically deployed

				have.Insert(addr.Service.Name)
			}
		}
		return have
	}, want, retry.Timeout(time.Second*3))
}

func (s *ambientTestServer) assertWorkloads(t *testing.T, lookup string, state workloadapi.WorkloadStatus, names ...string) {
	t.Helper()
	want := sets.New(names...)
	assert.EventuallyEqual(t, func() sets.String {
		workloads := s.lookup(lookup)
		have := sets.New[string]()
		for _, wl := range workloads {