apiVersion: release-notes/v2
kind: bug-fix
area: traffic-management
issue:
  - 50572
releaseNotes:
- |

bookinfo      bookinfo-rev           rev1         True
bookinfo      bookinfo-valid         default      True
default       bookinfo               default      False
default       no-name-convention     default      True

apiVersion: release-notes/v2
kind: bug-fix
area: installation
releaseNotes:
- |

		// We intentionally do not take into account waypoints here.
		// 1. Workload waypoints: sidecar/ingress do not support sending traffic directly to workloads, only to services,
		//    so these are not applicable.
		// 2. Service waypoints: in ztunnel, we would defer handling service traffic if the service has a waypoint, and instead

					Spec:      policy,
				},
			},
		},
		{
			name: "waypoint service attached",
			selectionOpts: WorkloadPolicyMatcher{
				IsWaypoint: true,
				Service:    "foo-svc",
				Namespace:  "foo",
				WorkloadLabels: labels.Instance{
					constants.GatewayNameLabel: "foo-waypoint",
					// labels match in selector policy but ignore them for waypoint
					"app":     "httpbin",
					"version": "v1",
				},
			},

// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

package waypoint

import (
	"bytes"
	"context"
	"fmt"
	"os"
	"strings"
	"testing"

	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
	gateway "sigs.k8s.io/gateway-api/apis/v1"

	"istio.io/api/label"

{
  "configs": [
    {
      "@type": "type.googleapis.com/envoy.admin.v3.BootstrapConfigDump",
      "bootstrap": {
        "node": {
          "id": "waypoint~192.168.252.229~httpbin-istio-waypoint-58f646c5ff-dbfkz.default~default.svc.cluster.local",
          "metadata": {
            "ISTIO_PROXY_SHA": "ee85c5f28702f00621aed895915fca565796b9e4",
            "ISTIO_VERSION": "1.21.0-1226",
            "metadata": {
              "build.type": "RELEASE",

					targetType:   "gateway",
					targetName:   fmt.Sprintf("%s-gateway", GetTarget().(echo.Instances).ServiceName()),
				},
				{
					desc:       "Configure WebAssembly filter for waypoint",
					name:       "waypoint-wasm-test",
					targetType: "gateway",
					targetName: constants.DefaultNamespaceWaypoint,
				},
				{
					desc:       "Configure WebAssembly filter for specific service",

		"If enabled, zTunnel will receive synthetic authorization policies for each workload ALLOW the Waypoint's identity. "+
			"Unless other ALLOW policies are created, this effectively denies traffic that doesn't go through the waypoint.")
)

// registerAmbient registers a variable that is allowed only if EnableAmbient is set
func registerAmbient[T env.Parseable](name string, defaultWithAmbient, defaultWithoutAmbient T, description string) T {

	SidecarProxy NodeType = "sidecar"

	// Router type is used for standalone proxies acting as L7/L4 routers
	Router NodeType = "router"

	// Waypoint type is used for waypoint proxies
	Waypoint NodeType = "waypoint"

	// Ztunnel type is used for node proxies (ztunnel)
	Ztunnel NodeType = "ztunnel"
)