ip, _ := netip.AddrFromSlice(b) // Address only comes from objects we create, so it must be valid
	return ip
}

func (a index) getWaypointAddress(w *Waypoint) *workloadapi.GatewayAddress {
	// probably overly cautious... I don't think the ambient index impl counts something with zero addresses as waypoint
	if w != nil && len(w.Addresses) >= 1 {
		return &workloadapi.GatewayAddress{
			Destination: &workloadapi.GatewayAddress_Address{

| ------------------- |:--------------------------:| :----------------:|
| **Cluster-Scoped**  | CRDs + validation          | CNI<br>ztunnel    |
| **Workload-Scoped** | istiod<br>tags + revisions |  waypoint (envoy) |

		},
	}
	for _, tt := range cases {
		t.Run(tt.name, func(t *testing.T) {
			mock := krttest.NewMock(t, tt.inputs)
			a := newAmbientUnitTest()
			builder := a.serviceEntryServiceBuilder(
				krttest.GetMockCollection[Waypoint](mock),
				krttest.GetMockCollection[*v1.Namespace](mock),
			)
			wrapper := builder(krt.TestingDummyContext{}, tt.se)
			res := slices.Map(wrapper, func(e model.ServiceInfo) *workloadapi.Service {
				return e.Service

		"kube-gateway": file.AsStringOrFail(t, filepath.Join(env.IstioSrc, "manifests/charts/istio-control/istio-discovery/files/kube-gateway.yaml")),
		"waypoint":     file.AsStringOrFail(t, filepath.Join(env.IstioSrc, "manifests/charts/istio-control/istio-discovery/files/waypoint.yaml")),
	})
	if err != nil {
		t.Fatal(err)
	}
	injConfig := func() inject.WebhookConfig {
		return inject.WebhookConfig{
			Templates:  tmpl,

	// Waypoint is the waypoint proxy for this service. When set, all incoming requests must go
	// through the waypoint.
	Waypoint *GatewayAddress `protobuf:"bytes,7,opt,name=waypoint,proto3" json:"waypoint,omitempty"`
	// Load balancing policy for selecting endpoints.
	// Note: this applies only to connecting directly to the workload; when waypoints are used, the waypoint's load_balancing

	"istio.io/istio/istioctl/pkg/tag"
	"istio.io/istio/istioctl/pkg/util"
	"istio.io/istio/istioctl/pkg/validate"
	"istio.io/istio/istioctl/pkg/version"
	"istio.io/istio/istioctl/pkg/wait"
	"istio.io/istio/istioctl/pkg/waypoint"
	"istio.io/istio/istioctl/pkg/workload"
	"istio.io/istio/istioctl/pkg/ztunnelconfig"
	"istio.io/istio/operator/cmd/mesh"
	"istio.io/istio/pkg/cmd"
	"istio.io/istio/pkg/collateral"
	"istio.io/istio/pkg/config/constants"

func (node *Proxy) IsWaypointProxy() bool {
	return node.Type == Waypoint
}

// IsZTunnel returns true if the proxy is acting as a ztunnel in an ambient mesh.
func (node *Proxy) IsZTunnel() bool {
	return node.Type == Ztunnel
}

// IsAmbient returns true if the proxy is acting as either a ztunnel or a waypoint proxy in an ambient mesh.

							HeadersToAdd: headers,
						},
					}),
				},
			}},
		}},
	}
	return l
}

// buildWaypointHTTPFilters augments the common chain of Waypoint-bound HTTP filters.
// Authn/authz filters are pre-pended. Telemetry filters are appended.
func (lb *ListenerBuilder) buildWaypointHTTPFilters(svc *model.Service) (pre []*hcm.HttpFilter, post []*hcm.HttpFilter) {

				GetMeshConfig(mock),
				krttest.GetMockCollection[model.WorkloadAuthorization](mock),
				krttest.GetMockCollection[*securityclient.PeerAuthentication](mock),
				krttest.GetMockCollection[Waypoint](mock),
				WorkloadServices,
				WorkloadServicesNamespaceIndex,
				krttest.GetMockCollection[*v1.Namespace](mock),
				krttest.GetMockCollection[*v1.Node](mock),
			)

	IPFamilyPolicy string

	DualStack bool

	// ServiceWaypointProxy specifies if this workload should have an associated Waypoint for service-addressed traffic
	ServiceWaypointProxy string

	// WorkloadWaypointProxy specifies if this workload should have an associated Waypoint for workload-addressed traffic
	WorkloadWaypointProxy string
}

// Getter for a custom echo deployment
type ConfigGetter func() []Config