}
			t.ConfigIstio().Eval(apps.Namespace.Name(), map[string]string{
				"Destination": "waypoint",
			}, `apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
  name: inbound
spec:
  workloadSelector:
    labels:
      gateway.networking.k8s.io/gateway-name: "{{.Destination}}"
  configPatches:
  - applyTo: HTTP_FILTER
    match:
      context: SIDECAR_INBOUND
      listener:
        filterChain:

				},
				Providers: []*tpb.ProviderRef{
					{
						Name: "envoy",
					},
				},
			},
		},
	}
	sidecarClient := &tpb.Telemetry{
		Selector: &v1beta1.WorkloadSelector{
			MatchLabels: labels,
		},
		AccessLogging: []*tpb.AccessLogging{
			{
				Match: &tpb.AccessLogging_LogSelector{
					Mode: tpb.WorkloadMode_CLIENT,
				},
				Providers: []*tpb.ProviderRef{

		implicitEndpoints := len(eps) == 0 &&
			(se.Spec.Resolution == networkingv1alpha3.ServiceEntry_DNS || se.Spec.Resolution == networkingv1alpha3.ServiceEntry_DNS_ROUND_ROBIN) &&
			se.Spec.WorkloadSelector == nil
		if len(eps) == 0 && !implicitEndpoints {
			return nil
		}
		// here we don't care about the *service* waypoint (hence it is nil); we are only going to use a subset of the info in

				Name:              "selector",
				Namespace:         "default",
				CreationTimestamp: time.Now(),
			},
			Spec: &security.PeerAuthentication{
				Selector: &v1beta1.WorkloadSelector{MatchLabels: map[string]string{"type": "eds-benchmark"}},
				Mtls:     &security.PeerAuthentication_MutualTLS{Mode: security.PeerAuthentication_MutualTLS_DISABLE},
			},
		})
	return result
}

		selector1 := func() *config.Config {
			c := httpStaticOverlay.DeepCopy()
			se := c.Spec.(*networking.ServiceEntry)
			se.Hosts = append(se.Hosts, "selector1.com")
			se.Endpoints = nil
			se.WorkloadSelector = &networking.WorkloadSelector{
				Labels: map[string]string{"app": "wle"},
			}
			return &c
		}()
		createConfigs([]*config.Config{selector1}, store, t)
		// Service change, so we need a full push

						SubjectAltNames:    []string{"foo.default.svc.cluster.local"},
						InsecureSkipVerify: &wrappers.BoolValue{Value: true},
					},
				},
				WorkloadSelector: &v1beta1.WorkloadSelector{},
			},
			enableAutoSni:            false,
			enableVerifyCertAtClient: true,
			expectTLSContext: &tls.UpstreamTlsContext{
				CommonTlsContext: &tls.CommonTlsContext{

  name: remote-we-svc
  namespace: test
spec:
  hosts:
  - remote-we-svc
  ports:
    - number: 80
      name: http
      protocol: HTTP
  resolution: STATIC
  location: MESH_INTERNAL
  workloadSelector:
    labels:
      app: remote-we-svc
`,
		},
	}
	workloadCases := []struct {
		name         string
		entries      []entry
		expectations map[string][]xdstest.LocLbEpInfo
	}{
		{

                    required:
                    - targetHost
                    - targetPort
                    type: object
                type: object
              workloadSelector:
                description: Criteria used to select the specific set of pods/VMs
                  on which this `DestinationRule` configuration should be applied.
                properties:

                    required:
                    - targetHost
                    - targetPort
                    type: object
                type: object
              workloadSelector:
                description: Criteria used to select the specific set of pods/VMs
                  on which this `DestinationRule` configuration should be applied.
                properties:

      port:
        name: tls
        number: 9080
        protocol: %s
      tls:
        mode: SIMPLE
        privateKey: "httpbinkey.pem"
        serverCertificate: "httpbin.pem"
  workloadSelector:
    labels:
      app: foo
---
`, protocol)
	}
	sidecarMutual := func(protocol string) string {
		return fmt.Sprintf(`
apiVersion: networking.istio.io/v1alpha3
kind: Sidecar