apiVersion: release-notes/v2
kind: feature
area: traffic-management
issue:
  - 49851
releaseNotes:
- |

	}
	switch proxy.Type {
	case model.Waypoint:
		if model.HasConfigsOfKind(req.ConfigsUpdated, kind.Address) {
			// TODO: this logic is identical to that used in LDS, consider refactor into a common function
			// taken directly from LDS... waypoints need CDS updates on kind.Address changes
			// after implementing use-waypoint which decouples waypoint creation, wl pod creation

	Zone    string `json:"zone,omitempty"`
	Subzone string `json:"subzone,omitempty"`
}

type ZtunnelWorkload struct {
	WorkloadIPs           []string          `json:"workloadIps"`
	Waypoint              *GatewayAddress   `json:"waypoint,omitempty"`
	NetworkGateway        *GatewayAddress   `json:"networkGateway,omitempty"`
	Protocol              string            `json:"protocol"`
	Name                  string            `json:"name"`

			"waypoint",
			"apply",
			"--namespace",
			apps.Namespace.Name(),
			"--name", "captured-waypoint",
			"--wait",
		})
		t.Cleanup(func() {
			istioctl.NewOrFail(t, t, istioctl.Config{}).InvokeOrFail(t, []string{
				"waypoint",
				"delete",
				"--namespace",
				apps.Namespace.Name(),
				"captured-waypoint",
			})
		})

apiVersion: release-notes/v2
kind: feature
area: istioctl
issue:
  - 49896
releaseNotes:
- |

apiVersion: release-notes/v2
kind: feature
area: istioctl
issue:
  - 50248
releaseNotes:
- |

apiVersion: release-notes/v2
kind: feature
area: istioctl
releaseNotes:
- |

# release notes.
releaseNotes:
- |

		kind.KubernetesGateway,
	),
	model.Waypoint: sets.New(
		kind.Gateway,
		kind.WorkloadGroup,
		kind.WorkloadEntry,
		kind.Secret,
		kind.ProxyConfig,
		kind.DNSName,

		kind.KubernetesGateway,
	),
}

func ldsNeedsPush(proxy *model.Proxy, req *model.PushRequest) bool {
	if req == nil {
		return true
	}
	switch proxy.Type {
	case model.Waypoint:

If the target destination has a waypoint, we enforce that the request is coming from that waypoint. Otherwise, the request is rejected.
If there is no waypoint, ztunnel will enforce RBAC policies against the request.

If all checks pass, ztunnel will open a connection to the target. This will spoof the source IP (from `Forwarded` for waypoints, or the incoming IP otherwise).