cfg.DNSServersV6 = []string{"::127.0.0.53"}
				cfg.ProxyGID = "1,2"
				cfg.ProxyUID = "3,4"
			},
		},
		{
			"outbound-owner-groups",
			func(cfg *config.Config) {
				cfg.RedirectDNS = true
				cfg.OwnerGroupsInclude = "java,202"
			},
		},
		{
			"outbound-owner-groups-exclude",
			func(cfg *config.Config) {
				cfg.RedirectDNS = true
				cfg.OwnerGroupsExclude = "888,ftp"
			},
		},
		{

    value:
      stringMatch:
        prefix: istio-ext-authz
  grpcService:
    envoyGrpc:
      authority: my-custom-ext-authz.foo.svc.cluster.local
      clusterName: outbound|9000||my-custom-ext-authz.foo.svc.cluster.local
    timeout: 600s
  statusOnError:
    code: Forbidden

	slices.Sort(res["outbound|80||example.com"])
	assert.Equal(t, res, map[string][]string{
		"outbound|8080||example.com": {"example.com:8080"},
		// Kind of weird to have multiple here, but it is what it is...
		// If we had targetPort, etc, set here this would be required
		"outbound|80||example.com": {
			"endpoint-port-override.example.com:2345",

    content: |
      This change impacts internal implementation of how Envoy "filters" are ordered. These filters run in order to implement various functionality.
      
      The ordering is now consistent across inbound, outbound and gateway proxy modes, as well as HTTP and TCP protocols:
      
      * Metadata Exchange
      * CUSTOM Authz
      * WASM Authn
      * Authn
      * WASM Authz
      * Authz
      * WASM Stats

				},
			},
		},
	})

	return env
}

func buildFakeCluster() *cluster.Cluster {
	return &cluster.Cluster{
		Name: "outbound|8080||test.example.org",
		LoadAssignment: &endpoint.ClusterLoadAssignment{
			ClusterName: "outbound|8080||test.example.org",
			Endpoints: []*endpoint.LocalityLbEndpoints{
				{
					Locality: &core.Locality{
						Region:  "region1",

				"test.local:80": {"test.local"},
				"test:80":       {"test"},
			},
			map[string]string{
				"allow_any":     "PassthroughCluster",
				"test.local:80": "outbound|80||test.local",
				"test:80":       "outbound|80||test",
			},
		},
		{
			"more exact first with full cluster domain",
			[]*model.Service{
				buildHTTPService("test.default.svc.cluster.local", visibility.Public, "", "default", 80),

	Connections WorkloadConnections `json:"connections,omitempty"`
	Info        WorkloadInfo        `json:"info"`
}

type WorkloadConnections struct {
	Inbound  []InboundConnection  `json:"inbound"`
	Outbound []OutboundConnection `json:"outbound"`
}

type WorkloadInfo struct {
	Name           string `json:"name"`
	Namespace      string `json:"namespace"`
	TrustDomain    string `json:"trustDomain"`

Eoin Fennessy <******@****.***> 1715615475 +0100

    value:
      stringMatch:
        prefix: istio-ext-authz
  grpcService:
    envoyGrpc:
      authority: my-custom-ext-authz.foo.svc.cluster.local
      clusterName: outbound|9000||my-custom-ext-authz.foo.svc.cluster.local
    timeout: 600s
  statusOnError:
    code: Forbidden

var redisOpTimeout = 5 * time.Second

func buildMetadataExchangeNetworkFilters() []*listener.Filter {
	filterstack := make([]*listener.Filter, 0)
	// We add metadata exchange on inbound only; outbound is handled in cluster filter
	if features.MetadataExchange {
		filterstack = append(filterstack, xdsfilters.TCPListenerMx)
	}

	return filterstack
}