statusCode int
				from       echo.Instances
				to         echo.Instances
			}{
				{
					name:       "workloads within same usergroup can communicate, same namespace",
					statusCode: http.StatusOK,
					from:       apps.NS[0].A,
					to:         apps.NS[0].B,
				},
				{
					name:       "workloads within same usergroup can communicate, different namespaces",
					statusCode: http.StatusOK,

      app: ratings-app # Multiple sidecars select overlapping workloads, should generate errors for both
  egress:
  - hosts:
    - "./*"
---
apiVersion: networking.istio.io/v1alpha3
kind: Sidecar
metadata:
  name: overlap-2
  namespace: default
spec:
  workloadSelector:
    labels:
      myapp: ratings-myapp # Multiple sidecars select overlapping workloads, should generate errors for both
  egress:
  - hosts:

}

func (f fakeInstance) Addresses() []string {
	panic("implement me")
}

func (f fakeInstance) Workloads() (echo.Workloads, error) {
	panic("implement me")
}

func (f fakeInstance) WorkloadsOrFail(test.Failer) echo.Workloads {
	panic("implement me")
}

func (f fakeInstance) MustWorkloads() echo.Workloads {
	panic("implement me")
}

func (f fakeInstance) Clusters() cluster.Clusters {

	// Addresses of service in dualmode
	Addresses() []string

	// Restart restarts the workloads associated with this echo instance
	Restart() error

	// UpdateWorkloadLabel update pod labels of this echo instance
	UpdateWorkloadLabel(add map[string]string, remove []string) error

	// WithWorkloads returns a target with only the specified subset of workloads
	WithWorkloads(wl ...Workload) Instance

	services        map[host.Name]*model.Service
	orderedServices []*model.Service
}

// findWaypointResources returns workloads and services associated with the waypoint proxy
func findWaypointResources(node *model.Proxy, push *model.PushContext) ([]model.WorkloadInfo, *waypointServices) {
	key := model.WaypointKeyForProxy(node)
	workloads := push.WorkloadsForWaypoint(key)
	serviceInfos := push.ServicesForWaypoint(key)

apiVersion: release-notes/v2
kind: bug-fix
area: telemetry
releaseNotes:
  - |
    **Fixed** a bug where `destination_cluster` reported by client proxies may be wrong

# The following policy selects all workloads in namespace 1

apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: policy-{{ .Namespace.Prefix }}-all
spec:
  rules:
    - to:
        - operation:

# The following policy selects workloads for the service in all namespaces

apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: policy-system-{{ .To.ServiceName }}
spec:
  selector:
    matchLabels:
      "app": "{{ .To.ServiceName }}"
  rules:
  - to:
    - operation:
        paths: ["/policy-system-{{ .To.ServiceName }}"]

		ip: "10.10.10.30", port: 9090,
		metaNetwork: "vm",
	}
	// VM always sees itself directly
	vm.Expect(vm, "10.10.10.30:9090")

	workloads := []*workload{pod, vm}

	var kubeObjects []runtime.Object
	var configObjects []config.Config
	for _, w := range workloads {
		_, objs := w.kubeObjects()
		kubeObjects = append(kubeObjects, objs...)
		configObjects = append(configObjects, w.configs()...)
	}

Istio security node agent provides cert provision service for workloads....