},
                            {
                              "tag": "istio.canonical_service",
                              "literal": {
                                "value": "namespace-istio-waypoint"
                              }
                            },
                            {
                              "tag": "istio.cluster_id",
                              "literal": {

	http3Only bool

	class istionetworking.ListenerClass
	port  int
	hbone bool

	// Waypoint-specific modifications in HCM
	isWaypoint bool

	// allow service attached policy for to-service chains
	// currently only used for waypoints
	policySvc *model.Service
}

// filterChainOpts describes a filter chain: a set of filters with the same TLS context

	res := make([]*hcm.HttpFilter, 0, len(metricsCfg))
	for _, cfg := range metricsCfg {
		switch cfg.Provider.GetProvider().(type) {
		case *meshconfig.MeshConfig_ExtensionProvider_Prometheus:
			if cfg.NodeType == Waypoint {
				f := &hcm.HttpFilter{
					Name:       xds.StatsFilterName,
					ConfigType: &hcm.HttpFilter_TypedConfig{TypedConfig: waypointStatsConfig},
				}
				res = append(res, f)
			} else {

// Used when calculating the workloads which should be configured for a specific waypoint proxy
func (ps *PushContext) WorkloadsForWaypoint(key WaypointKey) []WorkloadInfo {
	return ps.ambientIndex.WorkloadsForWaypoint(key)
}

// ServicesForWaypoint returns all services associated with a given waypoint identified by it's WaypointKey

	}

	if t.Settings().Ambient {
		if t.Settings().AmbientEverywhere {
			for i, config := range defaultConfigs {
				if !config.HasSidecar() && !config.IsProxylessGRPC() {
					scopes.Framework.Infof("adding waypoint to %s", config.NamespacedName())
					defaultConfigs[i].ServiceWaypointProxy = "shared"
					defaultConfigs[i].WorkloadWaypointProxy = "shared"
				}
			}
		} else {
			waypointed := echo.Config{

                            },
                            {
                              "tag": "istio.canonical_service",
                              "literal": {
                                "value": "namespace-istio-waypoint"
                              }
                            },
                            {
                              "tag": "istio.cluster_id",
                              "literal": {

}

const defaultSidecar = "default-sidecar"

// DefaultSidecarScopeForGateway builds a SidecarScope contains services and destinationRules for a given gateway/waypoint.
func DefaultSidecarScopeForGateway(ps *PushContext, configNamespace string) *SidecarScope {
	services := ps.servicesExportedToNamespace(configNamespace)
	out := &SidecarScope{
		Name:                    defaultSidecar,

      {{- if .Values.global.imagePullSecrets }}
      imagePullSecrets:
        {{- range .Values.global.imagePullSecrets }}
        - name: {{ . }}
        {{- end }}
      {{- end }}
  waypoint: |
    apiVersion: v1
    kind: ServiceAccount
    metadata:
      name: {{.ServiceAccount | quote}}
      namespace: {{.Namespace | quote}}
      annotations:

      {{- if .Values.global.imagePullSecrets }}
      imagePullSecrets:
        {{- range .Values.global.imagePullSecrets }}
        - name: {{ . }}
        {{- end }}
      {{- end }}
  waypoint: |
    apiVersion: v1
    kind: ServiceAccount
    metadata:
      name: {{.ServiceAccount | quote}}
      namespace: {{.Namespace | quote}}
      annotations:

      {{- if .Values.global.imagePullSecrets }}
      imagePullSecrets:
        {{- range .Values.global.imagePullSecrets }}
        - name: {{ . }}
        {{- end }}
      {{- end }}
  waypoint: |
    apiVersion: v1
    kind: ServiceAccount
    metadata:
      name: {{.ServiceAccount | quote}}
      namespace: {{.Namespace | quote}}
      annotations: