params+=("--uds-name=/etc/srv/kubernetes/konnectivity-server/konnectivity-server.socket")
  elif [[ "${KONNECTIVITY_SERVICE_PROXY_PROTOCOL_MODE:-grpc}" == 'http-connect' ]]; then
    # HTTP-CONNECT can work with either UDS or mTLS.
    # Linking them here to make sure we get good coverage with two test configurations.
    params+=("--server-ca-cert=${KONNECTIVITY_SERVER_CA_CERT_PATH}")

}

func (lb *ListenerBuilder) buildWaypointInbound() []*listener.Listener {
	listeners := []*listener.Listener{}
	// We create 3 listeners:
	// 1. Decapsulation CONNECT listener.
	// 2. IP dispatch listener, handling both VIPs and direct pod IPs.
	// 3. Encapsulation CONNECT listener, originating the tunnel
	wls, wps := findWaypointResources(lb.node, lb.push)

	listeners = append(listeners,
		lb.buildWaypointInboundConnectTerminate(),

		"The UDS server address which CNI plugin will forward ambient pod creation events to")
	registerStringParameter(constants.ZtunnelUDSAddress, "/var/run/ztunnel/ztunnel.sock", "The UDS server address which ztunnel will connect to")
	registerBooleanParameter(constants.AmbientEnabled, false, "Whether ambient controller is enabled")
	// Repair
	registerBooleanParameter(constants.RepairEnabled, true, "Whether to enable race condition repair or not")

	// is is usually the VIP. Tere will always be at least one address in this
	// list.
	Addresses []netip.Addr

	// DefaultBinding for an inbound zTunnel to use to connect to a Waypoint it captures.
	// This is applied to the Workloads that are instances of the current Waypoint.
	DefaultBinding InboundBinding

	// TrafficType controls whether Service or Workload can reference this

		return
	}
	cred, err := auth.GetNewCredentialsWithMetadata(claims, secret)
	if err != nil {
		writeSTSErrorResponse(ctx, w, ErrSTSInternalError, err)
		return
	}

	// https://openid.net/specs/openid-connect-core-1_0.html#ClaimStability
	// claim is only considered stable when subject and iss are used together
	// this is to ensure that ParentUser doesn't change and we get to use

  // A (network,address) pair makeup a unique key for a workload *at a point in time*.
  string network = 4;

  // Protocol that should be used to connect to this workload.
  TunnelProtocol tunnel_protocol = 5;

  // The SPIFFE identity of the workload. The identity is joined to form spiffe://<trust_domain>/ns/<namespace>/sa/<service_account>.

	}{
		{
			username: "Пользователь",
			dn:       "uid=Пользователь,ou=people,ou=swengg,dc=min,dc=io",
		},
	}

	conn, err := globalIAMSys.LDAPConfig.LDAP.Connect()
	if err != nil {
		c.Fatalf("LDAP connect failed: %v", err)
	}
	defer conn.Close()

	for i, testCase := range cases {
		ldapID := cr.LDAPIdentity{
			Client:       s.TestSuiteCommon.client,

        distribution = new UnderDevelopmentGradleDistribution(getBuildContext(), isolatedGradleHomeDir)
        recreateExecuter()
        executer.requireIsolatedDaemons() //otherwise we might connect to a running daemon from the original installation location
        executer
    }

    /**
     * Configure the test directory so that there is no settings.gradle(.kts) anywhere in its hierarchy.

		"5xx",
		"gateway-error",
		"reset",
		"connect-failure",
		"retriable-4xx",
		"refused-stream",
		"retriable-status-codes",
		"retriable-headers",
		"envoy-ratelimited",
		"http3-post-connect-failure",

		// 'x-envoy-retry-grpc-on' supported policies:

	// use_downstream_protocol should be disabled for gateway; while it sort of makes sense there, even
	// without sniffing, a concern is that clients will do ALPN negotiation, and we always advertise
	// h2. Clients would then connect with h2, while the upstream may not support it. This is not a
	// concern for plaintext, but we do not have a way to distinguish https vs http here. If users of