// 1.2 Check that svc account appears in listing
	c.assertSvcAccAppearsInListing(ctx, s.adm, accessKey, cr.AccessKey)

	// 1.3 Check that svc account info can be queried
	c.assertSvcAccInfoQueryable(ctx, s.adm, accessKey, cr.AccessKey, false)

	// 2. Check that svc account can access the bucket
	c.assertSvcAccS3Access(ctx, s, cr, bucket)

	// 3. Check that svc account can restrict the policy, and that the

                                        "name": "inbound-vip|80||sleep.default.svc.cluster.local-http",
                                        "typed_config": {
                                          "@type": "type.googleapis.com/google.protobuf.StringValue",
                                          "value": "inbound-vip|80||sleep.default.svc.cluster.local-http"
                                        }

                      "operation": "productpage.default.svc.cluster.local:9080/productpage"
                    }
                  },
                  {
                    "match": {
                      "prefix": "/static",
                      "case_sensitive": true
                    },
                    "route": {
                      "cluster": "outbound|9080||productpage.default.svc.cluster.local",
                      "timeout": "0s",

		return "None"
	}

	for _, svc := range services {
		if fmt.Sprintf("%s/%s", svc.Namespace, svc.Hostname) == wl.Waypoint.Destination {
			return svc.Name
		}
		for _, addr := range svc.Addresses {
			if addr == wl.Waypoint.Destination {
				return svc.Name
			}
		}
	}

	return "NA" // Shouldn't normally reach here
}

func serviceWaypointName(svc *ZtunnelService, services []*ZtunnelService) string {

          "address": "/10.244.2.8",
          "port": {
            "443": 8443
          }
        }
      },
      "subjectAltNames": []
    },
    "/10.96.198.255": {
      "name": "productpage",
      "namespace": "default",
      "hostname": "productpage.default.svc.cluster.local",
      "vips": [
        "/10.96.198.255"

./mc admin user svcacct info minio1 testsvc
if [ $? -ne 0 ]; then
	echo "svc account not mirrored, exiting.."
	exit_1
fi

./mc admin user svcacct info minio2 testsvc
if [ $? -ne 0 ]; then
	echo "svc account not mirrored, exiting.."
	exit_1
fi

./mc admin user svcacct info minio3 testsvc
if [ $? -ne 0 ]; then
	echo "svc account not mirrored, exiting.."
	exit_1
fi

if [ $? -ne 0 ]; then
	echo "adding svc account failed, exiting.."
	exit_1
fi

sleep 10

./mc admin user svcacct info minio1 testsvc
if [ $? -ne 0 ]; then
	echo "svc account not mirrored, exiting.."
	exit_1
fi

./mc admin user svcacct info minio2 testsvc
if [ $? -ne 0 ]; then
	echo "svc account not mirrored, exiting.."
	exit_1
fi

            // and send it as a separate request instead
            String svc = null;
            int t = this.tid;
            request.setTid(t);

            if ( !transport.isSMB2() ) {
                ServerMessageBlock req = (ServerMessageBlock) request;
                svc = this.service;
                if ( svc == null ) {
                    // there still is some kind of race condition, where?

            "@type": "type.googleapis.com/envoy.extensions.filters.network.tcp_proxy.v3.TcpProxy",
            "stat_prefix": "outbound|15021||ratings-istio-waypoint.ambient.svc.cluster.local",
            "cluster": "outbound|15021||ratings-istio-waypoint.ambient.svc.cluster.local"
           }
          }
         ]
        }
       ],
       "traffic_direction": "OUTBOUND",
       "bind_to_port": false
      },

            "name": "inbound-vip|8000|http|httpbin.default.svc.cluster.local",
            "type": "EDS",
            "eds_cluster_config": {
              "eds_config": {
                "ads": {},
                "initial_fetch_timeout": "0s",
                "resource_api_version": "V3"
              },
              "service_name": "inbound-vip|8000|http|httpbin.default.svc.cluster.local"
            },
            "transport_socket": {