}}
		ep.Metadata.FilterMetadata[util.OriginalDstMetadataKey] = util.BuildTunnelMetadataStruct(address, port)
		if b.dir != model.TrafficDirectionInboundVIP {
			// Add TLS metadata matcher to indicate we can use HBONE for this endpoint.
			// We skip this for service waypoint, which doesn't need to dynamically match mTLS vs HBONE.
			ep.Metadata.FilterMetadata[util.EnvoyTransportSocketMetadataKey] = &structpb.Struct{

		}
	}
}

func verifyALPNOverride(t *testing.T, md *core.Metadata, tlsMode networking.ClientTLSSettings_TLSmode) {
	istio, ok := md.FilterMetadata[util.IstioMetadataKey]
	if tlsMode == networking.ClientTLSSettings_SIMPLE || tlsMode == networking.ClientTLSSettings_MUTUAL {
		if !ok {
			t.Errorf("Istio metadata not found")
		}

			// check workload metadata
			var gotWorkloadMetadata []string
			for _, llbEndpoints := range filtered {
				for _, ep := range llbEndpoints.LbEndpoints {
					metadata := ep.Metadata.FilterMetadata[util.IstioMetadataKey].Fields["workload"].GetStringValue()
					gotWorkloadMetadata = append(gotWorkloadMetadata, metadata)
				}
			}
			if !slices.Equal(gotWorkloadMetadata, tt.wantWorkloadMetadata) {

			return true
		}
	}

	return false
}

// getIstioConfig returns .metadata.filter_metadata.istio.config, err
func getIstioConfig(metadata *core.Metadata) (string, error) {
	if metadata != nil {
		istioConfig := asMyProtoValue(metadata.FilterMetadata[util.IstioMetadataKey]).
			keyAsString("config")
		return istioConfig, nil
	}
	return "", fmt.Errorf("no istio config")
}

                          503
                        ]
                      },
                      "max_grpc_timeout": "0s"
                    },
                    "metadata": {
                      "filter_metadata": {
                        "istio": {
                          "config": "/apis/networking.istio.io/v1alpha3/namespaces/default/virtual-service/bookinfo"
                        }
                      }

                                        },
                                        "health_status": "HEALTHY",
                                        "metadata": {
                                            "filter_metadata": {
                                                "envoy.transport_socket_match": {
                                                    "tlsMode": "istio"
                                                },

                          503
                        ]
                      },
                      "max_grpc_timeout": "0s"
                    },
                    "metadata": {
                      "filter_metadata": {
                        "istio": {
                          "config": "/apis/networking.istio.io/v1alpha3/namespaces/default/virtual-service/bookinfo"
                        }
                      }

             503
            ]
           },
           "cluster_not_found_response_code": "INTERNAL_SERVER_ERROR",
           "max_grpc_timeout": "0s"
          },
          "metadata": {
           "filter_metadata": {
            "istio": {
             "config": "/apis/networking.istio.io/v1alpha3/namespaces/default/virtual-service/http-0-istio-autogenerated-k8s-gateway"
            }
           }
          },

            "retriable_status_codes": [
             503
            ]
           },
           "max_grpc_timeout": "0s"
          },
          "metadata": {
           "filter_metadata": {
            "istio": {
             "config": "/apis/networking.istio.io/v1alpha3/namespaces/default/virtual-service/httpbin"
            }
           }
          },
          "decorator": {

                  }
                }
              }
            },
            "metadata": {
              "filter_metadata": {
                "istio": {
                  "services": [
                    {
                      "name": "httpbin",
                      "namespace": "default",