func SourceMatcher(ns namespace.Instance, skipVM bool) match.Matcher {
	m := match.ServiceName(echo.NamespacedName{
		Name:      ASvc,
		Namespace: ns,
	})

	if !skipVM {
		m = match.Or(m, match.ServiceName(echo.NamespacedName{
			Name:      VMSvc,
			Namespace: ns,
		}))
	}

	return m
}

				Apply()

			newTrafficTest(t, fromAndTo).
				FromMatch(fromMatch).
				ToMatch(toMatch).
				Run(func(t framework.TestContext, from echo.Instance, to echo.Target) {
					allow := allowValue(from.NamespacedName() == allowed.NamespacedName())

					cases := []struct {
						ports []echo.Port
						path  string
						allow allowValue
					}{
						{
							ports: []echo.Port{ports.GRPC, ports.TCP},
							allow: allow,

			spn: proxy.ServicePortName{
				NamespacedName: types.NamespacedName{
					Namespace: "testing",
					Name:      "service",
				},
				Port: "http",
			},
			protocol: "tcp",
			expected: "P4ZYZVCF-testing/service/tcp/http",
		},
		{
			name: "different port, different hash",
			spn: proxy.ServicePortName{
				NamespacedName: types.NamespacedName{
					Namespace: "testing",

		events <- fmt.Sprintf(e.Latest().Name, e.Event)
	})
}

type legacy struct {
	pods      kclient.Client[*v1.Pod]
	services  kclient.Client[*v1.Service]
	queue     controllers.Queue
	workloads map[types.NamespacedName]*Workload
	handler   func(event krt.Event[Workload])
}

func getPodServices(allServices []*v1.Service, pod *v1.Pod) []*v1.Service {
	var services []*v1.Service
	for _, service := range allServices {

		TrustDomain:    "cluster.local",
		Namespace:      p.namespace,
		ServiceAccount: p.account,
	}.String()
}

func TestSingleClusterNodeAuthorization(t *testing.T) {
	allowZtunnel := map[types.NamespacedName]struct{}{
		{Name: "ztunnel", Namespace: "istio-system"}: {},
	}
	ztunnelCaller := security.KubernetesInfo{
		PodName:           "ztunnel-a",
		PodNamespace:      "istio-system",
		PodUID:            "12345",

		// Right now model.Config is not a proto - until we change it, mcp.Resource.
		// This also helps migrating MCP users.

		b, err := config.PilotConfigToResource(&c)
		if err != nil {
			log.WithLabels("resource", c.NamespacedName()).Warnf("resource error: %v", err)
			continue
		}
		resp = append(resp, &discovery.Resource{
			Name:     c.Namespace + "/" + c.Name,
			Resource: protoconv.MessageToAny(b),
		})
	}

		targetRefs = []*v1beta1.PolicyTargetReference{p.GetTargetRef()}
	}
	return targetRefs
}

func (p WorkloadPolicyMatcher) ShouldAttachPolicy(kind config.GroupVersionKind, policyName types.NamespacedName, policy TargetablePolicy) bool {
	gatewayName, isGatewayAPI := workloadGatewayName(p.WorkloadLabels)
	targetRefs := GetTargetRefs(policy)

	// non-gateway: use selector
	if !isGatewayAPI {

	// Used to remove duplicated config
	configMap := sets.NewWithLength[types.NamespacedName](configCnt)
	for _, curConfigs := range storeConfigs {
		configs = append(configs, curConfigs...)
	}
	configs = slices.FilterInPlace[config.Config](configs, func(cfg config.Config) bool {
		return !configMap.InsertContains(cfg.NamespacedName())
	})

	return configs
}

func (fb *FakeBinding) GetName() string {
	return fb.Name
}

func (fb *FakeBinding) GetNamespace() string {
	return fb.Namespace
}

func (fb *FakeBinding) GetPolicyName() types.NamespacedName {
	return types.NamespacedName{
		Name: fb.PolicyName,
	}
}

func (fb *FakeBinding) GetMatchResources() *v1.MatchResources {
	return nil
}

func (fb *FakeBinding) GetParamRef() *v1.ParamRef {
	return nil

func PodOnNodeFromDaemonset(node string, name, namespace string, client kube.Client) (types.NamespacedName, error) {
	ds, err := client.Kube().AppsV1().DaemonSets(namespace).Get(context.Background(), name, metav1.GetOptions{})
	if err != nil {
		return types.NamespacedName{}, err
	}
	selector := ds.Spec.Selector
	if selector == nil {
		return types.NamespacedName{}, fmt.Errorf("selector is required")
	}

	sel := selector.MatchLabels