},
		&discoveryv1.EndpointSlice{
			ObjectMeta: baseMeta,
			Endpoints: []discoveryv1.Endpoint{{
				Addresses:  []string{w.ip},
				Conditions: discoveryv1.EndpointConditions{},
				Hostname:   nil,
				TargetRef: &corev1.ObjectReference{
					APIVersion: "v1",
					Kind:       "Pod",
					Name:       podMeta.Name,
					Namespace:  podMeta.Namespace,
				},
				DeprecatedTopology: nil,
				NodeName:           nil,

	if endpointIP == "" {
		return nil, fmt.Errorf("failed to find a matching endpoint for service %v", svc.Name)
	}

	return &v1.EndpointAddress{
		IP:       endpointIP,
		NodeName: &pod.Spec.NodeName,
		TargetRef: &v1.ObjectReference{
			Kind:      "Pod",
			Namespace: pod.ObjectMeta.Namespace,
			Name:      pod.ObjectMeta.Name,
			UID:       pod.ObjectMeta.UID,
		},
	}, nil
}

		refs = make([]*corev1.ObjectReference, len(ips))
	}
	var portNum int32 = 1001
	eas := make([]corev1.EndpointAddress, 0)
	for i, ip := range ips {
		eas = append(eas, corev1.EndpointAddress{IP: ip, TargetRef: refs[i]})
	}

	eps := make([]corev1.EndpointPort, 0)
	for _, name := range portNames {
		eps = append(eps, corev1.EndpointPort{Name: name, Port: portNum})
	}

	endpoint := &corev1.Endpoints{

	// Description: Selector has no effect when applied to Kubernetes Gateways.
	IneffectiveSelector = diag.NewMessageType(diag.Warning, "IST0166", "Ineffective selector on Kubernetes Gateway %s. Use the TargetRef field instead.")

	// IneffectivePolicy defines a diag.MessageType for message "IneffectivePolicy".
	// Description: The policy applied has no impact.

                      pods/VMs on which a policy should be applied.
                    type: object
                type: object
              targetRef:
                description: Optional.
                properties:
                  group:
                    description: group is the group of the target resource.
                    type: string

	*out = *in
	if in.NodeName != nil {
		in, out := &in.NodeName, &out.NodeName
		*out = new(string)
		**out = **in
	}
	if in.TargetRef != nil {
		in, out := &in.TargetRef, &out.TargetRef
		*out = new(ObjectReference)
		**out = **in
	}
	return
}

// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new EndpointAddress.

	*out = *in
	if in.NodeName != nil {
		in, out := &in.NodeName, &out.NodeName
		*out = new(string)
		**out = **in
	}
	if in.TargetRef != nil {
		in, out := &in.TargetRef, &out.TargetRef
		*out = new(ObjectReference)
		**out = **in
	}
	return
}

// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new EndpointAddress.

            "type": "string"
          },
          "targetRef": {
            "allOf": [
              {
                "$ref": "#/components/schemas/io.k8s.api.core.v1.ObjectReference"
              }
            ],
            "description": "targetRef is a reference to a Kubernetes object that represents this endpoint."
          },
          "zone": {

		nil)

	s.addPolicy(t, "gateway-targeted", testNS, nil, gvk.AuthorizationPolicy, func(o controllers.Object) {
		p := o.(*clientsecurityv1beta1.AuthorizationPolicy)
		p.Spec.TargetRef = &v1beta1.PolicyTargetReference{
			Group: gvk.KubernetesGateway.Group,
			Kind:  gvk.KubernetesGateway.Kind,
			Name:  "dummy-waypoint",
		}
	})

	},
	{
		Meta: config.Meta{Name: uuid.NewString(), Namespace: "istio-system", GroupVersionKind: gvk.AuthorizationPolicy},
		Spec: &security.AuthorizationPolicy{
			Selector:     nil,
			TargetRef:    nil,
			Rules:        nil,
			Action:       security.AuthorizationPolicy_CUSTOM,
			ActionDetail: &security.AuthorizationPolicy_Provider{Provider: &security.AuthorizationPolicy_ExtensionProvider{Name: "extauthz"}},