targetType:   "gateway",
					targetName:   fmt.Sprintf("%s-gateway", GetTarget().(echo.Instances).ServiceName()),
				},
				{
					desc:       "Configure WebAssembly filter for waypoint",
					name:       "waypoint-wasm-test",
					targetType: "gateway",
					targetName: constants.DefaultNamespaceWaypoint,
				},
				{
					desc:       "Configure WebAssembly filter for specific service",

		"If enabled, zTunnel will receive synthetic authorization policies for each workload ALLOW the Waypoint's identity. "+
			"Unless other ALLOW policies are created, this effectively denies traffic that doesn't go through the waypoint.")
)

// registerAmbient registers a variable that is allowed only if EnableAmbient is set
func registerAmbient[T env.Parseable](name string, defaultWithAmbient, defaultWithoutAmbient T, description string) T {

	ip, _ := netip.AddrFromSlice(b) // Address only comes from objects we create, so it must be valid
	return ip
}

func (a index) getWaypointAddress(w *Waypoint) *workloadapi.GatewayAddress {
	// probably overly cautious... I don't think the ambient index impl counts something with zero addresses as waypoint
	if w != nil && len(w.Addresses) >= 1 {
		return &workloadapi.GatewayAddress{
			Destination: &workloadapi.GatewayAddress_Address{

| ------------------- |:--------------------------:| :----------------:|
| **Cluster-Scoped**  | CRDs + validation          | CNI<br>ztunnel    |
| **Workload-Scoped** | istiod<br>tags + revisions |  waypoint (envoy) |

		},
	}
	for _, tt := range cases {
		t.Run(tt.name, func(t *testing.T) {
			mock := krttest.NewMock(t, tt.inputs)
			a := newAmbientUnitTest()
			builder := a.serviceEntryServiceBuilder(
				krttest.GetMockCollection[Waypoint](mock),
				krttest.GetMockCollection[*v1.Namespace](mock),
			)
			wrapper := builder(krt.TestingDummyContext{}, tt.se)
			res := slices.Map(wrapper, func(e model.ServiceInfo) *workloadapi.Service {
				return e.Service

	VMSvc            = "vm"
	HeadlessSvc      = "headless"
	StatefulSetSvc   = "statefulset"
	ProxylessGRPCSvc = "proxyless-grpc"
	NakedSvc         = "naked"
	SotwSvc          = "sotw"
	WaypointSvc      = "waypoint"
	CapturedSvc      = "captured"
)

// EchoNamespace contains the echo instances for a single namespace.
type EchoNamespace struct {
	// Namespace where the services are deployed.
	Namespace namespace.Instance

				Prefix: "gateway-conformance-infra",
				Inject: false,
			})
			if err != nil {
				t.Fatal(err)
			}
			ns.RemoveLabel(constants.DataplaneModeLabel)

			// create a waypoint for mesh conformance
			meshNS := namespace.Static("gateway-conformance-mesh")
			ambientComponent.NewWaypointProxyOrFail(ctx, meshNS, "namespace")
			for _, k := range ctx.AllClusters() {

					Value: model.HBoneInboundListenPort,
				},
				// Used to override destination pods with waypoints.
				MetadataKey: &metadata.MetadataKey{
					Key: util.OriginalDstMetadataKey,
					Path: []*metadata.MetadataKey_PathSegment{{
						Segment: &metadata.MetadataKey_PathSegment_Key{
							Key: "waypoint",
						},
					}},
				},
			},
		},
		TransportSocket: &core.TransportSocket{

apiVersion: release-notes/v2
kind: feature
area: traffic-management
issue:
  - 46540

releaseNotes:
- |

apiVersion: release-notes/v2
kind: bug-fix
area: traffic-management
releaseNotes:
  - |
    **Fixed** Waypoints missing the `ISTIO_META_NETWORK` field. It can be configured at install time using