imagePullSecrets:
            {{- range .Values.global.imagePullSecrets }}
            - name: {{ . }}
            {{- end }}
          {{- end }}
      waypoint: |
        apiVersion: v1
        kind: ServiceAccount
        metadata:
          name: {{.ServiceAccount | quote}}
          namespace: {{.Namespace | quote}}
          annotations:

        tagsta[label="tag stable->1.18.5"]
    }

    subgraph cluster_app {
        rankdir=TB
        node [style=filled];
        appcontents[label="App Pods"]
        appwp[label="App Waypoints"]
        ig[label="Ingress Gateway"]
        nwc[label="App Network Configs"]
        fontsize="24"
        label = "NS ambient";
    }
    fontsize="32"
    label = "Application Cluster";
    style=filled

		}
		return p.isSelected(policy)
	}

	// gateway with no targetRefs: (sometimes) fallback to selector
	if len(targetRefs) == 0 {
		// gateways require the feature flag for selector-based policy
		// waypoints never use selector
		if p.IsWaypoint || !features.EnableSelectorBasedK8sGatewayPolicy {

		createPod(s, "pod2", "sa", "127.0.0.2", "node")
		expect(ads.ExpectResponse(), "Kubernetes//Pod/default/pod2")

		// TODO: implement pod update; this actually cannot really be done without waypoints or VIPs
		deletePod(s, "pod")
		expectRemoved(ads.ExpectResponse(), "Kubernetes//Pod/default/pod")

		// Create pod we are not subscribed to; due to same-node optimization this will push