Scope     string             `json:"scope"`
	Action    string             `json:"action"`
	Rules     [][][]*PolicyMatch `json:"rules"`
}

type ZtunnelDump struct {
	Workloads     []*ZtunnelWorkload       `json:"workloads"`
	Services      []*ZtunnelService        `json:"services"`
	Policies      []*ZtunnelPolicy         `json:"policies"`
	Certificates  []*CertsDump             `json:"certificates"`

Most of the API is fairly straight forward.
However, one interesting aspect is how these policies associate with workloads.
Istio's AuthorizationPolicy has label selectors.
However, we intentionally do not send those as part of the Workload API, in order to keep the size low.

The obvious solution to this is to put the list of selected workloads into the policy itself.
However, this means anytime a workload changes (often), we need to update the policy.

    // This could be a single Pod, a VM instance, etc.
    Workload workload = 1;
    // Service represents a service - a group of workloads that can be accessed together.
    Service service = 2;
  }
}

// Service represents a service - a group of workloads that can be accessed together.
// The xds primary key is "namespace/hostname".

# This shows an example local config for ztunnel that adds a workload for localhost.
# This allows local testing by sending requests through the local ztunnel to other servers running on localhost.
workloads:
- uid: cluster1//v1/Pod/default/local
  name: local
  namespace: default
  serviceAccount: default
  workloadIps: ["127.0.0.1"]
  protocol: HBONE
  node: local
  network: ""
  services:
    "default/example.com":
      80: 8080

			// Weight is tripled because:
			// - This is a score coming from user preference.
			// - Usage of node tainting to group nodes in the cluster is increasing becoming a use-case
			// for many user workloads
			{Name: names.TaintToleration, Weight: 3},
			// Weight is doubled because:
			// - This is a score coming from user preference.
			{Name: names.NodeAffinity, Weight: 2},
			{Name: names.NodeResourcesFit, Weight: 1},

}

func (f fakeInstance) Addresses() []string {
	panic("implement me")
}

func (f fakeInstance) Workloads() (echo.Workloads, error) {
	panic("implement me")
}

func (f fakeInstance) WorkloadsOrFail(test.Failer) echo.Workloads {
	panic("implement me")
}

func (f fakeInstance) MustWorkloads() echo.Workloads {
	panic("implement me")
}

func (f fakeInstance) Clusters() cluster.Clusters {

  // More info: https://kubernetes.io/docs/concepts/workloads/controllers/jobs-run-to-completion/#specifying-your-own-pod-selector
  // +optional
  optional bool manualSelector = 5;

  // Describes the pod that will be created when executing a job.
  // The only allowed template.spec.restartPolicy values are "Never" or "OnFailure".
  // More info: https://kubernetes.io/docs/concepts/workloads/controllers/jobs-run-to-completion/

	"istio.io/istio/pkg/test/framework/components/echo/match"
	"istio.io/istio/pkg/test/framework/components/istio"
	"istio.io/istio/pkg/test/framework/components/namespace"
)

// TestReachability verifies:
// (a) Different workloads after getting their certificates signed by the K8s CA are successfully able to communicate with each other
func TestReachability(t *testing.T) {
	framework.NewTest(t).
		Run(func(t framework.TestContext) {

					Address: netip.MustParseAddr(expectedIP).AsSlice(),
				},
			},
			HboneMtlsPort: 15008,
		}
	}
	workloads := s.lookup(s.podXdsName(key))
	if len(workloads) < 1 {
		t.Log("no workloads provided, assertion must fail")
		t.Fail()
	}
	for _, workload := range workloads {
		assert.Equal(t, expectedAddress.String(), workload.GetWorkload().GetWaypoint().String())
	}
}

	s.ns.CreateOrUpdate(&corev1.Namespace{
		ObjectMeta: metav1.ObjectMeta{
			Name: testNS,
			Labels: map[string]string{
				constants.AmbientUseWaypointLabel: "waypoint-ns",
			},
		},
	})
	// All these workloads updated, so push them
	s.assertEvent(t,
		s.wleXdsName("name1"),
		s.wleXdsName("name2"),
		s.wleXdsName("name3"),
	)
	// create the waypoint service
	s.addService(t, "waypoint-ns",