{
  "configs": [
    {
      "@type": "type.googleapis.com/envoy.admin.v3.BootstrapConfigDump",
      "bootstrap": {
        "node": {
          "id": "waypoint~192.168.252.229~httpbin-istio-waypoint-58f646c5ff-dbfkz.default~default.svc.cluster.local",
          "metadata": {
            "ISTIO_PROXY_SHA": "ee85c5f28702f00621aed895915fca565796b9e4",
            "ISTIO_VERSION": "1.21.0-1226",
            "metadata": {
              "build.type": "RELEASE",

           "typed_config": {
            "@type": "type.googleapis.com/envoy.extensions.filters.network.tcp_proxy.v3.TcpProxy",
            "stat_prefix": "outbound|15021||ratings-istio-waypoint.ambient.svc.cluster.local",
            "cluster": "outbound|15021||ratings-istio-waypoint.ambient.svc.cluster.local"
           }
          }
         ]
        }
       ],
       "traffic_direction": "OUTBOUND",
       "bind_to_port": false

					targetType:   "gateway",
					targetName:   fmt.Sprintf("%s-gateway", GetTarget().(echo.Instances).ServiceName()),
				},
				{
					desc:       "Configure WebAssembly filter for waypoint",
					name:       "waypoint-wasm-test",
					targetType: "gateway",
					targetName: constants.DefaultNamespaceWaypoint,
				},
				{
					desc:       "Configure WebAssembly filter for specific service",

		"If enabled, zTunnel will receive synthetic authorization policies for each workload ALLOW the Waypoint's identity. "+
			"Unless other ALLOW policies are created, this effectively denies traffic that doesn't go through the waypoint.")
)

// registerAmbient registers a variable that is allowed only if EnableAmbient is set
func registerAmbient[T env.Parseable](name string, defaultWithAmbient, defaultWithoutAmbient T, description string) T {

	SidecarProxy NodeType = "sidecar"

	// Router type is used for standalone proxies acting as L7/L4 routers
	Router NodeType = "router"

	// Waypoint type is used for waypoint proxies
	Waypoint NodeType = "waypoint"

	// Ztunnel type is used for node proxies (ztunnel)
	Ztunnel NodeType = "ztunnel"
)

	ip, _ := netip.AddrFromSlice(b) // Address only comes from objects we create, so it must be valid
	return ip
}

func (a index) getWaypointAddress(w *Waypoint) *workloadapi.GatewayAddress {
	// probably overly cautious... I don't think the ambient index impl counts something with zero addresses as waypoint
	if w != nil && len(w.Addresses) >= 1 {
		return &workloadapi.GatewayAddress{
			Destination: &workloadapi.GatewayAddress_Address{

| ------------------- |:--------------------------:| :----------------:|
| **Cluster-Scoped**  | CRDs + validation          | CNI<br>ztunnel    |
| **Workload-Scoped** | istiod<br>tags + revisions |  waypoint (envoy) |

		},
	}
	for _, tt := range cases {
		t.Run(tt.name, func(t *testing.T) {
			mock := krttest.NewMock(t, tt.inputs)
			a := newAmbientUnitTest()
			builder := a.serviceEntryServiceBuilder(
				krttest.GetMockCollection[Waypoint](mock),
				krttest.GetMockCollection[*v1.Namespace](mock),
			)
			wrapper := builder(krt.TestingDummyContext{}, tt.se)
			res := slices.Map(wrapper, func(e model.ServiceInfo) *workloadapi.Service {
				return e.Service

		"kube-gateway": file.AsStringOrFail(t, filepath.Join(env.IstioSrc, "manifests/charts/istio-control/istio-discovery/files/kube-gateway.yaml")),
		"waypoint":     file.AsStringOrFail(t, filepath.Join(env.IstioSrc, "manifests/charts/istio-control/istio-discovery/files/waypoint.yaml")),
	})
	if err != nil {
		t.Fatal(err)
	}
	injConfig := func() inject.WebhookConfig {
		return inject.WebhookConfig{
			Templates:  tmpl,

	// Waypoint is the waypoint proxy for this service. When set, all incoming requests must go
	// through the waypoint.
	Waypoint *GatewayAddress `protobuf:"bytes,7,opt,name=waypoint,proto3" json:"waypoint,omitempty"`
	// Load balancing policy for selecting endpoints.
	// Note: this applies only to connecting directly to the workload; when waypoints are used, the waypoint's load_balancing