if _, ok := annotationRegistry[name]; !ok {
		return false, "", fmt.Errorf("no registered annotation with name=%s", name)
	}
	// use annotation value if present
	if val, found := annotations[annotationRegistry[name].key]; found {
		if err := annotationRegistry[name].validator(val); err != nil {
			return true, annotationRegistry[name].defaultVal, err
		}
		return true, val, nil

	InsecureSkipVerify bool `protobuf:"varint,19,opt,name=insecureSkipVerify,proto3" json:"insecureSkipVerify,omitempty"`
	// List of ALPNs to present. If not set, this will be automatically be set based on the protocol
	Alpn *Alpn `protobuf:"bytes,13,opt,name=alpn,proto3" json:"alpn,omitempty"`
	// Server name (SNI) to present in TLS connections. If not set, Host will be used for http requests.

message DaemonSetUpdateStrategy {
  // Type of daemon set update. Can be "RollingUpdate" or "OnDelete". Default is RollingUpdate.
  // +optional
  optional string type = 1;

  // Rolling update config params. Present only if type = "RollingUpdate".
  // ---
  // TODO: Update this to follow our convention for oneOf, whatever we decide it
  // to be. Same as Deployment `strategy.rollingUpdate`.

  string trust_domain = 6;
  // ServiceAccount of the workload. May be elided if this is "default"
  string service_account = 7;

  // If present, the waypoint proxy for this workload.
  // All incoming requests must go through the waypoint.
  GatewayAddress waypoint = 8;

  // If present, East West network gateway this workload can be reached through.
  // Requests from remote networks should traverse this gateway.

// 4. Then we apply overrides from annotation (this comes from annotation on gateway, passed through downward API)
//
// Merging is done by replacement. Any fields present in the overlay will replace those existing fields, while
// untouched fields will remain untouched. This means lists will be replaced, not appended to, for example.

	Filters []string

	// TotalMatch will require that the all elements exactly match (eg, if I have 3 elements in the
	// check, the listener must as well). Otherwise, we only validate the assertions we provided are
	// present.
	TotalMatch bool
}

type FilterChainTest struct {
	// Match a filter chain by name
	Name string
	// Match filter chain by 'type'. This can be important since Name is currently not unique
	Type FilterChainType

                                    type: string
                                  sni:
                                    description: SNI string to present to the server
                                      during TLS handshake.
                                    type: string
                                  subjectAltNames:

			// Validate that keys in service still exist in EndpointIndex - this prevents full push.
			if _, ok := s.Discovery.Env.EndpointIndex.ShardsForService("flipflop.com", ""); !ok {
				t.Fatalf("Expected service key %s to be present in EndpointIndex. But missing %v", "flipflop.com", s.Discovery.Env.EndpointIndex.Shardz())
			}

			// Set the endpoints again and validate it does not trigger full push.
			s.MemRegistry.SetEndpoints("flipflop.com", "",

	case model.MTLSStrict:
		out = append(out, buildInboundFilterChain(node, push, "mtls", tlsContext))
		// TODO permissive builts both plaintext and mtls; when tlsContext is present add a match for protocol
	}

	return out
}

func buildInboundFilterChain(node *model.Proxy, push *model.PushContext, nameSuffix string, tlsContext *tls.DownstreamTlsContext) *listener.FilterChain {

  // key and content is the value. If specified, the listed keys will be
  // projected into the specified paths, and unlisted keys will not be
  // present. If a key is specified which is not present in the ConfigMap,
  // the volume setup will error unless it is marked optional. Paths must be
  // relative and may not contain the '..' path or start with '..'.
  // +optional