}

func implicitWaypointPolicy(ctx krt.HandlerContext, MeshConfig krt.Singleton[MeshConfig], waypoint Waypoint) *model.WorkloadAuthorization {
	if !features.DefaultAllowFromWaypoint || len(waypoint.ServiceAccounts) == 0 {
		return nil
	}
	meshCfg := krt.FetchOne(ctx, MeshConfig.AsCollection())
	return &model.WorkloadAuthorization{
		Authorization: &security.Authorization{

	tb.endpoints = spiffeEndpoints
	tb.endpointMutex.Unlock()
	tb.endpointUpdateChan <- struct{}{}
}

// AddMeshConfigUpdate : Update trustAnchor configurations from meshConfig
func (tb *TrustBundle) AddMeshConfigUpdate(cfg *meshconfig.MeshConfig) error {
	var err error
	if cfg != nil {
		certs := []string{}
		endpoints := []string{}
		for _, pemCert := range cfg.GetCaCertificates() {
			cert := pemCert.GetPem()

		*meshconfig.MeshConfig_ExtensionProvider_EnvoyExtAuthzGrpc,
		*meshconfig.MeshConfig_ExtensionProvider_Zipkin,
		*meshconfig.MeshConfig_ExtensionProvider_Lightstep,
		*meshconfig.MeshConfig_ExtensionProvider_Datadog,
		*meshconfig.MeshConfig_ExtensionProvider_Skywalking,
		*meshconfig.MeshConfig_ExtensionProvider_Opencensus,
		*meshconfig.MeshConfig_ExtensionProvider_Opentelemetry,
		*meshconfig.MeshConfig_ExtensionProvider_Prometheus,

proxyMetadata:
  SOME: setting
drainDuration: 1s
controlPlaneAuthPolicy: NONE`
	overridesExpected := func() *meshconfig.ProxyConfig {
		m := mesh.DefaultProxyConfig()
		m.DiscoveryAddress = "foo:123"
		m.ProxyMetadata = map[string]string{"SOME": "setting"}
		m.DrainDuration = durationpb.New(time.Second)
		m.ControlPlaneAuthPolicy = meshconfig.AuthenticationPolicy_NONE
		return m
	}()
	cases := []struct {
		name        string

			inputFlags: []string{
				"meshConfig.defaultConfig.proxyMetadata.ISTIO_DUAL_STACK=false",
				"meshConfig.defaultConfig.proxyMetadata.PROXY_XDS_VIA_AGENT=false",
			},
		}, {
			name:         "convention_integer",
			convertPaths: defaultSetFlagConvertPaths,
			inputFlags: []string{
				"meshConfig.defaultConfig.proxyMetadata.ISTIO_MULTI_CLUSTERS=10",
				"meshConfig.defaultConfig.proxyMetadata.PROXY_XDS_LISTENERS=20",

	}
	framework.NewTest(t).
		Run(func(t framework.TestContext) {
			cases := []struct {
				name         string
				ntype        meshconfig.MeshConfig_ProxyPathNormalization_NormalizationType
				expectations []expect
			}{
				{
					"None",
					meshconfig.MeshConfig_ProxyPathNormalization_NONE,
					[]expect{
						{"/", "/"},
						{"/app#foo", "/app"},
						{"/app/", "/app/"},

				Protocol: protocol.HTTP,
			},
		},
	})

	meshConfig := mesh.DefaultMeshConfig()
	meshConfig.AccessLogFile = model.DevStdout
	meshConfig.ExtensionProviders = append(meshConfig.ExtensionProviders, &meshconfig.MeshConfig_ExtensionProvider{
		Name: "envoy-json",
		Provider: &meshconfig.MeshConfig_ExtensionProvider_EnvoyFileAccessLog{
			EnvoyFileAccessLog: &meshconfig.MeshConfig_ExtensionProvider_EnvoyFileAccessLogProvider{

	// MeshConfig used by the Istio installation.
	MeshConfig() (*meshconfig.MeshConfig, error)
	MeshConfigOrFail(test.Failer) *meshconfig.MeshConfig
	// UpdateMeshConfig used by the Istio installation.
	UpdateMeshConfig(resource.Context, func(*meshconfig.MeshConfig) error, cleanup.Strategy) error
	UpdateMeshConfigOrFail(resource.Context, test.Failer, func(*meshconfig.MeshConfig) error, cleanup.Strategy)

{{ define "default-prometheus" }}
{{- and
  (not .Values.meshConfig.defaultProviders)
  .Values.telemetry.enabled .Values.telemetry.v2.enabled .Values.telemetry.v2.prometheus.enabled
}}
{{- end }}

{{/* SD has metrics and logging split. Default metrics are enabled if SD is enabled */}}
{{ define "default-sd-metrics" }}
{{- and
  (not .Values.meshConfig.defaultProviders)

{{ define "default-prometheus" }}
{{- and
  (not .Values.meshConfig.defaultProviders)
  .Values.telemetry.enabled .Values.telemetry.v2.enabled .Values.telemetry.v2.prometheus.enabled
}}
{{- end }}

{{/* SD has metrics and logging split. Default metrics are enabled if SD is enabled */}}
{{ define "default-sd-metrics" }}
{{- and
  (not .Values.meshConfig.defaultProviders)