Repository: kmesh-net/kmesh

Issue:
The output of "kmeshctl dump" is unordered
<!-- Please only use this template for submitting enhancement requests -->

**What would you like to be added**:
 Sort the output of 'kmeshctl dump.
**Why is this needed**:
Because the output of "kmeshctl dump" is unordered, it is inconvenient to compare the results from two different uses of dump. It would be better if it were ordered.

Discussion:
@hzxuzhonghu: /assign @zrggw

Solution patch:
diff --git a/.gitignore b/.gitignore
index c312fcbf..55e6e051 100644
--- a/.gitignore
+++ b/.gitignore
@@ -11,6 +11,7 @@ tools/vagrant/.vagrant/
 .run/
 # Visual Studio Code
 .vscode/
+.local/
 # Bazel
 /bazel-*
 # vi swap files
@@ -40,6 +41,7 @@ coverage.out
 # build artifacts
 *.so
 *.o
+*.o.tmp
 
 kernel/**/*.ko
 kernel/**/*.cmd
diff --git a/config/.gitignore b/config/.gitignore
new file mode 100644
index 00000000..8ba357ea
--- /dev/null
+++ b/config/.gitignore
@@ -0,0 +1 @@
+linux-bpf.h
\ No newline at end of file
diff --git a/docs/ebpf_unit_test_zh.md b/docs/ebpf_unit_test_zh.md
new file mode 100644
index 00000000..5358f4c4
--- /dev/null
+++ b/docs/ebpf_unit_test_zh.md
@@ -0,0 +1,240 @@
+# Kmesh eBPF 单元测试框架文档
+
+# 1. 框架概述
+
+Kmesh eBPF 单元测试框架是一个用于测试 eBPF 内核态程序的工具，支持多种 eBPF 程序类型的单元测试。该框架基于 Go 语言的单元测试框架，能够独立运行单个 eBPF 程序的测试，而无需加载整个 Kmesh 系统，从而提高测试效率和覆盖率。
+
+# 2. 目录结构
+
+测试框架的目录结构如下：
+
+```
+test/bpf_ut/
+├── bpftest/              # Go 语言实现的单元测试框架
+│   ├── bpf_test.go       # 测试框架核心逻辑以及辅助函数
+│   ├── trf.pb.go         # 由 trf.proto 生成的 Go 代码
+│   ├── trf.proto         # 测试结果格式定义
+│   ├── general_test.go   # bpf/kmesh/general相关测试用例以及辅助函数
+│   └── workload_test.go  # bpf/kmesh/workload相关测试用例以及辅助函数
+├── include/              # 测试相关头文件
+│   ├── ut_common.h       # 通用测试宏和函数
+│   ├── xdp_common.h      # XDP 测试相关函数和宏定义
+│   └── tc_common.h       # TC 测试相关函数和宏定义
+├── Makefile              # 构建和运行测试的脚本
+└── *_test.c              # 测试文件，如 xdp_authz_offload_test.c
+```
+
+# 3. 核心组件
+
+## 3.1 Go 语言实现的单元测试框架 (`bpftest/`)
+
+Go 语言实现的单元测试框架负责加载和执行 eBPF 程序，捕获测试结果并生成报告：
+
+- `bpf_test.go`：框架的核心组件，包含两种主要测试类型：
+  - **`unitTest_BPF_PROG_TEST_RUN`**：基于 `BPF_PROG_TEST_RUN` 机制，适用于 [BPF_PROG_TEST_RUN 文档](https://docs.ebpf.io/linux/syscall/BPF_PROG_TEST_RUN/)列出的支持测试 eBPF 程序类型。
+  - **`unitTest_BUILD_CONTEXT`**：针对 `BPF_PROG_TEST_RUN` 不支持的程序类型，需要在 Go 代码中构造自定义上下文，通过 `cilium/ebpf` 加载、执行并验证 eBPF 程序的行为。
+  - **`unitTests_*`**：针对每一个 `*_test.c` 测试文件，维护多个具体的测试项。
+- `trf.proto`：定义测试结果和测试过程日志格式的 Protocol Buffers 文件。
+
+## 3.2 测试头文件 (`include/`)
+
+- `ut_common.h`：提供测试宏和辅助函数，支持测试初始化、断言、日志记录等功能。
+- `xdp_common.h`：提供 XDP 程序测试相关的辅助函数，如构建和验证 XDP 数据包。
+- `tc_common.h`：提供 TC 程序测试相关的辅助函数，如构建和验证 TC 数据包。
+
+## 3.3 测试文件 (`*_test.c`)
+
+- 测试文件的核心在于引入单元测试相关的头文件（如 `ut_common.h`、`xdp_common.h` 和 `tc_common.h`）；mock 需要 mock 的下游函数；直接 include 需要测试的 eBPF 程序；编写内核态的测试逻辑。
+- 对于 `unittest_BPF_PROG_TEST_RUN` 类型的测试，一个测试项通常包含以下部分：
+  - mock：mock 需要 mock 的下游函数。
+  - include：直接 include 需要测试的 eBPF 程序。
+  - tail_call：使用 `tail_call` 机制调用被测试的 eBPF 程序。
+  - PKTGEN：生成测试数据包的函数，使用 `PKTGEN` 宏定义。
+  - JUMP：调用被测试的 eBPF 程序的函数，使用 `JUMP` 宏定义。
+  - CHECK：验证测试结果的函数，使用 `CHECK` 宏定义。
+- 对于 `unitTest_BUILD_CONTEXT` 类型的测试，测试项通常包含以下部分：
+  - mock：mock 需要 mock 的下游函数。
+  - include：直接 include 需要测试的 eBPF 程序。
+
+## 3.4 Makefile
+
+`Makefile` 负责使用 clang 编译 `*_test.c` 文件并生成相应的 `*_test.o` 文件，随后在执行时通过 Go 测试框架加载这些对象文件来进行测试。
+
+# 4. 测试框架工作原理
+
+## 4.1 `unitTest_BPF_PROG_TEST_RUN`
+
+该测试类型基于内核提供的 `BPF_PROG_TEST_RUN` 机制，用于直接验证支持 `BPF_PROG_TEST_RUN` 的 eBPF 程序。通过内核态快速调用，可方便地测试针对 XDP、TC 等常见程序类型的逻辑。
+对应的用户态 Go 测试代码会加载生成的 `.o` 文件，遍历被测程序并执行测试。对于每个测试项，还可在 `setupInUserSpace` 函数中做额外的初始化（如设置全局配置或更新 eBPF Map）。
+
+## 4.2 `unitTest_BUILD_CONTEXT`
+
+当需要测试不支持 `BPF_PROG_TEST_RUN` 的 eBPF 程序类型时，可使用 `unitTest_BUILD_CONTEXT`。这种测试模式需要在用户态自行构造上下文并载入 eBPF 对象文件，完成特殊场景下的验证。
+对应的用户态 Go 测试代码在 `workFunc` 中执行实际测试逻辑，如挂载 cgroup、加载并附加 sockops 程序，然后通过各种方式（如向 TCP 服务器发起连接）触发 eBPF 程序运行并进行验证。
+
+## 4.3 用户态 Go 测试代码
+
+无论采用哪种测试类型，都会在用户态利用 Go 测试框架对编译得到的 eBPF 程序进行加载、执行与结果校验。`bpf_test.go` 中定义了各类工具函数，如：
+- `loadAndRunSpec`：载入并初始化 `.o` 文件中的程序、Map。
+- `startLogReader`：读取 eBPF Map 中的 ringbuf 或日志输出。
+- `registerTailCall`：为特定测试场景注册 tail call。
+这样可以结合内核测试程序与用户态测试逻辑，为 eBPF 程序提供更完善的验证能力。
+
+# 5. 编写测试
+
+## 5.1 `unitTest_BPF_PROG_TEST_RUN`
+
+对于使用 `BPF_PROG_TEST_RUN` 机制的 eBPF 程序，测试文件通常包含 mock、include、tail_call、PKTGEN、JUMP、CHECK 等部分。
+
+eBPF 测试文件通常遵循以下结构：
+
+```c
+// sample_test.c
+#include "ut_common.h"
+#include "xdp_common.h"
+
+// 1. 定义必要的 eBPF 映射和常量
+
+// 2. 实现 PKTGEN 函数（生成测试数据包）
+PKTGEN("program_type", "test_name")
+int test_pktgen(struct xdp_md *ctx)
+{
+  // 设置测试数据
+  return build_xdp_packet(...);
+}
+
+// 3. 实现 JUMP 函数（调用被测试的 eBPF 程序）
+JUMP("program_type", "test_name")
+int test_jump(struct xdp_md *ctx)
+{
+  // 调用被测试的 eBPF 程序
+  bpf_tail_call(...);
+  return TEST_ERROR;
+}
+
+// 4. 实现 CHECK 函数（验证测试结果）
+CHECK("program_type", "test_name")
+int test_check(const struct xdp_md *ctx)
+{
+  // 验证测试结果
+  test_init();
+  check_xdp_packet(...);
+  test_finish();
+}
+```
+
+用户态 Go 代码需要在 `bpf_test.go` 中实现对应的测试逻辑。以下是一个简单的示例：
+
+```go
+func test(t *testing.T) {
+  tests := []unitTests_BPF_PROG_TEST_RUN{
+    {
+      objFilename: "sample_test.o",
+      uts: []unitTest_BPF_PROG_TEST_RUN{
+        {
+          name: "test_name", // 需要与 C 代码中的测试名称一致
+          setupInUserSpace: func(t *testing.T, coll *ebpf.Collection) {},
+        },
+      },
+    },
+  }
+
+  for _, tt := range tests {
+    t.Run(tt.objFilename, tt.run())
+  }
+}
+```
+
+## 5.2 `unitTest_BUILD_CONTEXT`
+
+当需要测试不支持 `BPF_PROG_TEST_RUN` 的 eBPF 程序时，可使用 `unitTest_BUILD_CONTEXT`。在这种模式下，用户态测试会主动在 `workFunc` 中挂载 cgroup 并加载 eBPF 对象进行验证。例如：
+
+```c
+// workload_sockops_test.c
+#include <linux/bpf.h>
+#include <bpf/bpf_helpers.h>
+#include "bpf_log.h"
+#include "bpf_common.h"
+
+// mock bpf_sk_storage_get
+struct sock_storage_data mock_storage = {
+  .via_waypoint = 1,
+};
+
+static void *mock_bpf_sk_storage_get(void *map, void *sk, void *value, __u64 flags)
+{
+  void *storage = NULL;
+  storage = bpf_sk_storage_get(map, sk, value, flags);
+  if (!storage && map == &map_of_sock_storage) {
+    storage = &mock_storage;
+  }
+  return storage;
+}
+
+#define bpf_sk_storage_get mock_bpf_sk_storage_get
+
+// 直接 include 需要测试的 eBPF 程序
+#include "workload/sockops.c"
+```
+
+对应的 Go 测试逻辑可能在 `workload_test.go` 里，通过附加到 cgroup 并建立 TCP 连接来触发 sockops：
+
+```go
+func TestWorkloadSockOps(t *testing.T) {
+  tests := []unitTests_BUILD_CONTEXT{
+    {
+      objFilename: "workload_sockops_test.o",
+      uts: []unitTest_BUILD_CONTEXT{
+        {
+          name: "sample_test",
+          workFunc: func(t *testing.T, cgroupPath, objFilePath string) {
+            // 加载 ebpf 内核态程序
+            coll, lk := load_bpf_2_cgroup(t, objFilePath, cgroupPath)
+            defer coll.Close()
+            defer lk.Close()
+
+            // 触发连接操作，检查 bpf_map 中记录结果
+          },
+        },
+      },
+    },
+  }
+  for _, tt := range tests {
+    t.Run(tt.objFilename, tt.run())
+  }
+}
+```
+
+## 5.3 测试宏
+
+框架提供了多种测试宏简化测试编写：
+
+- `test_log(fmt, ...)`：记录测试日志。
+- `assert(cond)`：断言条件为真，否则测试失败。
+- `test_fail() / test_fail_now()`：标记测试失败。
+- `test_skip() / test_skip_now()`：跳过当前测试。
+
+## 5.4 测试辅助宏
+
+对于 XDP 程序测试，框架提供了专门的辅助宏：
+
+- `build_xdp_packet`：构建 XDP 测试数据包。
+- `check_xdp_packet`：验证 XDP 数据包处理结果。
+
+对于 TC 程序测试，框架提供了专门的辅助宏：
+
+- `build_tc_packet`：构建 TC 测试数据包。
+- `check_tc_packet`：验证 TC 数据包处理结果。
+
+# 6. 运行测试
+
+测试可以通过 `Makefile` 中定义的命令运行：
+
+```bash
+cd kmesh
+make ebpf_unit_test
+```
+
+可以使用以下参数控制测试执行：
+
+- `V=1`：启用详细测试输出
\ No newline at end of file
diff --git a/go.mod b/go.mod
index e5b2cc5f..55f80e49 100644
--- a/go.mod
+++ b/go.mod
@@ -223,7 +223,7 @@ require (
 	gopkg.in/ini.v1 v1.67.0 // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
-	helm.sh/helm/v3 v3.16.3 // indirect
+	helm.sh/helm/v3 v3.16.4 // indirect
 	istio.io/client-go v1.24.2-0.20241206152608-3892aa679051 // indirect
 	k8s.io/apiextensions-apiserver v0.32.0 // indirect
 	k8s.io/apiserver v0.32.0 // indirect
diff --git a/go.sum b/go.sum
index 5d08cceb..da2678fe 100644
--- a/go.sum
+++ b/go.sum
@@ -663,8 +663,8 @@ gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gotest.tools/v3 v3.4.0 h1:ZazjZUfuVeZGLAmlKKuyv3IKP5orXcwtOwDQH6YVr6o=
 gotest.tools/v3 v3.4.0/go.mod h1:CtbdzLSsqVhDgMtKsx03ird5YTGB3ar27v0u/yKBW5g=
-helm.sh/helm/v3 v3.16.3 h1:kb8bSxMeRJ+knsK/ovvlaVPfdis0X3/ZhYCSFRP+YmY=
-helm.sh/helm/v3 v3.16.3/go.mod h1:zeVWGDR4JJgiRbT3AnNsjYaX8OTJlIE9zC+Q7F7iUSU=
+helm.sh/helm/v3 v3.16.4 h1:rBn/h9MACw+QlhxQTjpl8Ifx+VTWaYsw3rguGBYBzr0=
+helm.sh/helm/v3 v3.16.4/go.mod h1:k8QPotUt57wWbi90w3LNmg3/MWcLPigVv+0/X4B8BzA=
 honnef.co/go/tools v0.0.0-20190102054323-c2f93a96b099/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
 honnef.co/go/tools v0.0.0-20190523083050-ea95bdfd59fc/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
 istio.io/api v1.24.3 h1:iwWWPM0uEQ+oxRHvIWoB8MQ4bjF3dRQj+M5IDVczg0M=
diff --git a/hack/format.sh b/hack/format.sh
index d88f5a2b..82d044db 100755
--- a/hack/format.sh
+++ b/hack/format.sh
@@ -33,5 +33,9 @@ install_shell_format
 shfmt -w -s -ln=bash ./
 
 if [ -z "$GITHUB_ACTIONS" ]; then
-	docker run -u 0 -w /workspace -v "$PWD":/workspace davidanson/markdownlint-cli2:v0.18.1 "**/*.md" "--fix"
+	docker run --rm \
+		-v "$PWD":/workspace \
+		-w /workspace \
+		davidanson/markdownlint-cli2:v0.18.1 \
+		markdownlint-cli2 --fix "**/*.md"
 fi
diff --git a/kmesh_compile_env_pre.sh b/kmesh_compile_env_pre.sh
index 8723cd1e..fc28bc96 100644
--- a/kmesh_compile_env_pre.sh
+++ b/kmesh_compile_env_pre.sh
@@ -12,7 +12,6 @@ function install_libboundscheck() {
 }
 
 function dependency_pkg_install() {
-
 	if command -v apt >/dev/null; then
 		echo "Checking for required packages on a Debian-based system..."
 
diff --git a/pkg/status/status_server.go b/pkg/status/status_server.go
index 9486d4ce..bf6c52a4 100644
--- a/pkg/status/status_server.go
+++ b/pkg/status/status_server.go
@@ -23,6 +23,7 @@ import (
 	"io"
 	"net/http"
 	"net/http/pprof"
+	"sort"
 	"strconv"
 	"time"
 
@@ -568,6 +569,16 @@ func (s *Server) StopServer() error {
 }
 
 func printWorkloadDump(w http.ResponseWriter, wd WorkloadDump) {
+	sort.Slice(wd.Workloads, func(i, j int) bool {
+		return wd.Workloads[i].Name < wd.Workloads[j].Name
+	})
+	sort.Slice(wd.Services, func(i, j int) bool {
+		return wd.Services[i].Name < wd.Services[j].Name
+	})
+	sort.Slice(wd.Policies, func(i, j int) bool {
+		return wd.Policies[i].Name < wd.Policies[j].Name
+	})
+
 	data, err := json.MarshalIndent(wd, "", "    ")
 	if err != nil {
 		log.Errorf("Failed to marshal WorkloadDump: %v", err)



Test patch:
diff --git a/pkg/controller/security/manager_test.go b/pkg/controller/security/manager_test.go
index 98987819..1c46c897 100644
--- a/pkg/controller/security/manager_test.go
+++ b/pkg/controller/security/manager_test.go
@@ -24,6 +24,7 @@ import (
 	"github.com/agiledragon/gomonkey/v2"
 	"github.com/stretchr/testify/assert"
 	"istio.io/istio/pkg/security"
+	"istio.io/istio/pkg/test/util/retry"
 
 	camock "kmesh.net/kmesh/pkg/controller/security/mock"
 )
@@ -124,7 +125,7 @@ func runTestCertRotate(t *testing.T) {
 	for {
 		secretManager.certsCache.mu.RLock()
 		cert2 := secretManager.certsCache.certs[identity1]
-		if cert2 != nil && cert2.cert.CreatedTime != oldCert.CreatedTime {
+		if cert2 != nil && cert2.cert != nil && cert2.cert.CreatedTime != oldCert.CreatedTime {
 			newCert = *cert2.cert
 			secretManager.certsCache.mu.RUnlock()
 			break
@@ -160,13 +161,32 @@ func runTestretryFetchCert(t *testing.T) {
 
 	go secretManager.Run(stopCh)
 	identity := "identity"
-	identity1 := "identity1"
 	secretManager.SendCertRequest(identity, ADD)
 	time.Sleep(100 * time.Millisecond)
 	patches2.Reset()
-	secretManager.SendCertRequest(identity1, RETRY)
-	time.Sleep(2000 * time.Millisecond)
-	assert.NotNil(t, secretManager.GetCert(identity).cert)
+
+	secretManager.SendCertRequest(identity, RETRY)
+
+	err = retry.UntilSuccess(
+		func() error {
+			cert := secretManager.GetCert(identity)
+			if cert != nil {
+				secretManager.certsCache.mu.RLock()
+				hasCert := cert.cert != nil
+				secretManager.certsCache.mu.RUnlock()
+				if hasCert {
+					return nil
+				}
+			}
+			return fmt.Errorf("cert not found for identity %s", identity)
+		},
+		retry.Delay(100*time.Millisecond),
+		retry.Timeout(6*time.Second),
+	)
+
+	if err != nil {
+		t.Errorf("Failed to fetch cert after retry: %v", err)
+	}
 
 	close(stopCh)
 }
diff --git a/pkg/status/status_server_test.go b/pkg/status/status_server_test.go
index dea4b731..39141730 100644
--- a/pkg/status/status_server_test.go
+++ b/pkg/status/status_server_test.go
@@ -133,11 +133,11 @@ func TestServer_setLoggerLevel(t *testing.T) {
 	}
 }
 
-func TestServer_configDumpWorkload(t *testing.T) {
-	w1 := &workloadapi.Workload{
+func buildWorkload(name string) *workloadapi.Workload {
+	return &workloadapi.Workload{
 		Uid:               "cluster0//Pod/ns/name",
 		Namespace:         "ns",
-		Name:              "name",
+		Name:              name,
 		Addresses:         [][]byte{netip.AddrFrom4([4]byte{1, 2, 3, 4}).AsSlice()},
 		Network:           "testnetwork",
 		CanonicalName:     "foo",
@@ -173,10 +173,13 @@ func TestServer_configDumpWorkload(t *testing.T) {
 			},
 		},
 	}
-	svc := &workloadapi.Service{
-		Name:      "svc",
+}
+
+func buildService(name, hostname string) *workloadapi.Service {
+	return &workloadapi.Service{
+		Name:      name,
 		Namespace: "ns",
-		Hostname:  "hostname",
+		Hostname:  hostname,
 		Ports: []*workloadapi.Port{
 			{
 				ServicePort: 80,
@@ -199,6 +202,12 @@ func TestServer_configDumpWorkload(t *testing.T) {
 				},
 			},
 		}}
+}
+
+func TestServer_configDumpWorkload(t *testing.T) {
+	w := buildWorkload("name")
+	svc := buildService("svc", "hostname")
+
 	policy := &security.Authorization{
 		Name:      "policy",
 		Namespace: "ns",
@@ -207,7 +216,7 @@ func TestServer_configDumpWorkload(t *testing.T) {
 	}
 	fakeWorkloadCache := cache.NewWorkloadCache()
 	fakeServiceCache := cache.NewServiceCache()
-	fakeWorkloadCache.AddOrUpdateWorkload(w1)
+	fakeWorkloadCache.AddOrUpdateWorkload(w)
 	fakeServiceCache.AddOrUpdateService(svc)
 	fakeAuth := auth.NewRbac(fakeWorkloadCache)
 	fakeAuth.UpdatePolicy(policy)
@@ -225,20 +234,123 @@ func TestServer_configDumpWorkload(t *testing.T) {
 	}
 
 	// Create a new HTTP request and response
-	req := httptest.NewRequest(http.MethodGet, "/configDumpWorkload", nil)
-	w := httptest.NewRecorder()
+	req1 := httptest.NewRequest(http.MethodGet, "/configDumpWorkload", nil)
+	w1 := httptest.NewRecorder()
 
 	// Call the configDumpWorkload function
-	server.configDumpWorkload(w, req)
+	server.configDumpWorkload(w1, req1)
 
 	// Check the response status code
-	if w.Code != http.StatusOK {
-		t.Errorf("Expected status code %d, but got %d", http.StatusOK, w.Code)
+	if w1.Code != http.StatusOK {
+		t.Errorf("Expected status code %d, but got %d", http.StatusOK, w1.Code)
+	}
+
+	util.RefreshGoldenFile(t, w1.Body.Bytes(), "./testdata/workload_configdump.json")
+
+	util.CompareContent(t, w1.Body.Bytes(), "./testdata/workload_configdump.json")
+
+	fakeWorkloadCache = cache.NewWorkloadCache()
+	fakeServiceCache = cache.NewServiceCache()
+
+	workloads := []*workloadapi.Workload{}
+	services := []*workloadapi.Service{}
+
+	for i := 0; i < 10; i++ {
+		w := buildWorkload(fmt.Sprintf("workload-%d", i))
+		w.Uid = fmt.Sprintf("cluster0//Pod/ns/workload-%d", i)
+		workloads = append(workloads, w)
+		svc := buildService(fmt.Sprintf("service-%d", i), fmt.Sprintf("hostname-%d", i))
+		services = append(services, svc)
+
+		fakeWorkloadCache.AddOrUpdateWorkload(w)
+		fakeServiceCache.AddOrUpdateService(svc)
 	}
 
-	util.RefreshGoldenFile(t, w.Body.Bytes(), "./testdata/workload_configdump.json")
+	// Create a new HTTP response
+	w2 := httptest.NewRecorder()
+
+	server = &Server{
+		xdsClient: &controller.XdsClient{
+			WorkloadController: &workload.Controller{
+				Processor: &workload.Processor{
+					WorkloadCache: fakeWorkloadCache,
+					ServiceCache:  fakeServiceCache,
+				},
+				Rbac: fakeAuth,
+			},
+		},
+	}
+
+	// Call the configDumpWorkload function
+	server.configDumpWorkload(w2, req1)
+
+	// Check the response status code
+	if w2.Code != http.StatusOK {
+		t.Errorf("Expected status code %d, but got %d", http.StatusOK, w2.Code)
+	}
+
+	util.RefreshGoldenFile(t, w2.Body.Bytes(), "./testdata/workload_configdump_original_sorted.json")
+	util.CompareContent(t, w2.Body.Bytes(), "./testdata/workload_configdump_original_sorted.json")
+
+	fakeWorkloadCache = cache.NewWorkloadCache()
+	fakeServiceCache = cache.NewServiceCache()
+	// Modify workloads and services properties
+	for i := 0; i < 5; i++ { // Modify first 5 items
+		// Modify workload properties
+		w := buildWorkload(fmt.Sprintf("workload-%d-modified", i))
+		w.ClusterId = "cluster1" // Changed cluster
+		w.Uid = fmt.Sprintf("cluster1//Pod/ns/workload-%d-modified", i)
+		w.Status = workloadapi.WorkloadStatus_UNHEALTHY
+
+		workloads[i] = w
+		// Modify service properties
+		svc := buildService(fmt.Sprintf("service-%d-modified", i), fmt.Sprintf("hostname-%d-modified", i))
+		// Modify service ports
+		svc.Ports = []*workloadapi.Port{
+			{
+				ServicePort: 90,
+				TargetPort:  9090,
+			},
+			{
+				ServicePort: 91,
+				TargetPort:  0,
+			},
+			{
+				ServicePort: 92,
+				TargetPort:  0,
+			},
+		}
+		services[i] = svc
+	}
+	for _, w := range workloads {
+		fakeWorkloadCache.AddOrUpdateWorkload(w)
+	}
+	for _, svc := range services {
+		fakeServiceCache.AddOrUpdateService(svc)
+	}
+
+	w3 := httptest.NewRecorder()
+
+	server = &Server{
+		xdsClient: &controller.XdsClient{
+			WorkloadController: &workload.Controller{
+				Processor: &workload.Processor{
+					WorkloadCache: fakeWorkloadCache,
+					ServiceCache:  fakeServiceCache,
+				},
+				Rbac: fakeAuth,
+			},
+		},
+	}
+
+	server.configDumpWorkload(w3, req1)
+
+	if w3.Code != http.StatusOK {
+		t.Errorf("Expected status code %d, but got %d", http.StatusOK, w3.Code)
+	}
 
-	util.CompareContent(t, w.Body.Bytes(), "./testdata/workload_configdump.json")
+	util.RefreshGoldenFile(t, w3.Body.Bytes(), "./testdata/workload_configdump_modified_sorted.json")
+	util.CompareContent(t, w3.Body.Bytes(), "./testdata/workload_configdump_modified_sorted.json")
 }
 
 func TestServer_dumpWorkloadBpfMap(t *testing.T) {
diff --git a/pkg/status/testdata/workload_configdump_modified_sorted.json b/pkg/status/testdata/workload_configdump_modified_sorted.json
new file mode 100644
index 00000000..c983043b
--- /dev/null
+++ b/pkg/status/testdata/workload_configdump_modified_sorted.json
@@ -0,0 +1,495 @@
+{
+    "workloads": [
+        {
+            "uid": "cluster1//Pod/ns/workload-0-modified",
+            "addresses": [
+                "1.2.3.4"
+            ],
+            "waypoint": "testnetwork/192.168.1.10",
+            "protocol": "NONE",
+            "name": "workload-0-modified",
+            "namespace": "ns",
+            "serviceAccount": "",
+            "workloadName": "name",
+            "workloadType": "POD",
+            "canonicalName": "foo",
+            "canonicalRevision": "latest",
+            "clusterId": "cluster1",
+            "locality": {},
+            "node": "",
+            "network": "testnetwork",
+            "status": "UNHEALTHY",
+            "applicationTunnel": {
+                "protocol": ""
+            },
+            "services": [
+                "ns/hostname"
+            ]
+        },
+        {
+            "uid": "cluster1//Pod/ns/workload-1-modified",
+            "addresses": [
+                "1.2.3.4"
+            ],
+            "waypoint": "testnetwork/192.168.1.10",
+            "protocol": "NONE",
+            "name": "workload-1-modified",
+            "namespace": "ns",
+            "serviceAccount": "",
+            "workloadName": "name",
+            "workloadType": "POD",
+            "canonicalName": "foo",
+            "canonicalRevision": "latest",
+            "clusterId": "cluster1",
+            "locality": {},
+            "node": "",
+            "network": "testnetwork",
+            "status": "UNHEALTHY",
+            "applicationTunnel": {
+                "protocol": ""
+            },
+            "services": [
+                "ns/hostname"
+            ]
+        },
+        {
+            "uid": "cluster1//Pod/ns/workload-2-modified",
+            "addresses": [
+                "1.2.3.4"
+            ],
+            "waypoint": "testnetwork/192.168.1.10",
+            "protocol": "NONE",
+            "name": "workload-2-modified",
+            "namespace": "ns",
+            "serviceAccount": "",
+            "workloadName": "name",
+            "workloadType": "POD",
+            "canonicalName": "foo",
+            "canonicalRevision": "latest",
+            "clusterId": "cluster1",
+            "locality": {},
+            "node": "",
+            "network": "testnetwork",
+            "status": "UNHEALTHY",
+            "applicationTunnel": {
+                "protocol": ""
+            },
+            "services": [
+                "ns/hostname"
+            ]
+        },
+        {
+            "uid": "cluster1//Pod/ns/workload-3-modified",
+            "addresses": [
+                "1.2.3.4"
+            ],
+            "waypoint": "testnetwork/192.168.1.10",
+            "protocol": "NONE",
+            "name": "workload-3-modified",
+            "namespace": "ns",
+            "serviceAccount": "",
+            "workloadName": "name",
+            "workloadType": "POD",
+            "canonicalName": "foo",
+            "canonicalRevision": "latest",
+            "clusterId": "cluster1",
+            "locality": {},
+            "node": "",
+            "network": "testnetwork",
+            "status": "UNHEALTHY",
+            "applicationTunnel": {
+                "protocol": ""
+            },
+            "services": [
+                "ns/hostname"
+            ]
+        },
+        {
+            "uid": "cluster1//Pod/ns/workload-4-modified",
+            "addresses": [
+                "1.2.3.4"
+            ],
+            "waypoint": "testnetwork/192.168.1.10",
+            "protocol": "NONE",
+            "name": "workload-4-modified",
+            "namespace": "ns",
+            "serviceAccount": "",
+            "workloadName": "name",
+            "workloadType": "POD",
+            "canonicalName": "foo",
+            "canonicalRevision": "latest",
+            "clusterId": "cluster1",
+            "locality": {},
+            "node": "",
+            "network": "testnetwork",
+            "status": "UNHEALTHY",
+            "applicationTunnel": {
+                "protocol": ""
+            },
+            "services": [
+                "ns/hostname"
+            ]
+        },
+        {
+            "uid": "cluster0//Pod/ns/workload-5",
+            "addresses": [
+                "1.2.3.4"
+            ],
+            "waypoint": "testnetwork/192.168.1.10",
+            "protocol": "NONE",
+            "name": "workload-5",
+            "namespace": "ns",
+            "serviceAccount": "",
+            "workloadName": "name",
+            "workloadType": "POD",
+            "canonicalName": "foo",
+            "canonicalRevision": "latest",
+            "clusterId": "cluster0",
+            "locality": {},
+            "node": "",
+            "network": "testnetwork",
+            "status": "HEALTHY",
+            "applicationTunnel": {
+                "protocol": ""
+            },
+            "services": [
+                "ns/hostname"
+            ]
+        },
+        {
+            "uid": "cluster0//Pod/ns/workload-6",
+            "addresses": [
+                "1.2.3.4"
+            ],
+            "waypoint": "testnetwork/192.168.1.10",
+            "protocol": "NONE",
+            "name": "workload-6",
+            "namespace": "ns",
+            "serviceAccount": "",
+            "workloadName": "name",
+            "workloadType": "POD",
+            "canonicalName": "foo",
+            "canonicalRevision": "latest",
+            "clusterId": "cluster0",
+            "locality": {},
+            "node": "",
+            "network": "testnetwork",
+            "status": "HEALTHY",
+            "applicationTunnel": {
+                "protocol": ""
+            },
+            "services": [
+                "ns/hostname"
+            ]
+        },
+        {
+            "uid": "cluster0//Pod/ns/workload-7",
+            "addresses": [
+                "1.2.3.4"
+            ],
+            "waypoint": "testnetwork/192.168.1.10",
+            "protocol": "NONE",
+            "name": "workload-7",
+            "namespace": "ns",
+            "serviceAccount": "",
+            "workloadName": "name",
+            "workloadType": "POD",
+            "canonicalName": "foo",
+            "canonicalRevision": "latest",
+            "clusterId": "cluster0",
+            "locality": {},
+            "node": "",
+            "network": "testnetwork",
+            "status": "HEALTHY",
+            "applicationTunnel": {
+                "protocol": ""
+            },
+            "services": [
+                "ns/hostname"
+            ]
+        },
+        {
+            "uid": "cluster0//Pod/ns/workload-8",
+            "addresses": [
+                "1.2.3.4"
+            ],
+            "waypoint": "testnetwork/192.168.1.10",
+            "protocol": "NONE",
+            "name": "workload-8",
+            "namespace": "ns",
+            "serviceAccount": "",
+            "workloadName": "name",
+            "workloadType": "POD",
+            "canonicalName": "foo",
+            "canonicalRevision": "latest",
+            "clusterId": "cluster0",
+            "locality": {},
+            "node": "",
+            "network": "testnetwork",
+            "status": "HEALTHY",
+            "applicationTunnel": {
+                "protocol": ""
+            },
+            "services": [
+                "ns/hostname"
+            ]
+        },
+        {
+            "uid": "cluster0//Pod/ns/workload-9",
+            "addresses": [
+                "1.2.3.4"
+            ],
+            "waypoint": "testnetwork/192.168.1.10",
+            "protocol": "NONE",
+            "name": "workload-9",
+            "namespace": "ns",
+            "serviceAccount": "",
+            "workloadName": "name",
+            "workloadType": "POD",
+            "canonicalName": "foo",
+            "canonicalRevision": "latest",
+            "clusterId": "cluster0",
+            "locality": {},
+            "node": "",
+            "network": "testnetwork",
+            "status": "HEALTHY",
+            "applicationTunnel": {
+                "protocol": ""
+            },
+            "services": [
+                "ns/hostname"
+            ]
+        }
+    ],
+    "services": [
+        {
+            "name": "service-0-modified",
+            "namespace": "ns",
+            "hostname": "hostname-0-modified",
+            "vips": [],
+            "ports": [
+                {
+                    "service_port": 90,
+                    "target_port": 9090
+                },
+                {
+                    "service_port": 91
+                },
+                {
+                    "service_port": 92
+                }
+            ],
+            "loadBalancer": null,
+            "waypoint": {
+                "destination": "testnetwork/192.168.1.11"
+            }
+        },
+        {
+            "name": "service-1-modified",
+            "namespace": "ns",
+            "hostname": "hostname-1-modified",
+            "vips": [],
+            "ports": [
+                {
+                    "service_port": 90,
+                    "target_port": 9090
+                },
+                {
+                    "service_port": 91
+                },
+                {
+                    "service_port": 92
+                }
+            ],
+            "loadBalancer": null,
+            "waypoint": {
+                "destination": "testnetwork/192.168.1.11"
+            }
+        },
+        {
+            "name": "service-2-modified",
+            "namespace": "ns",
+            "hostname": "hostname-2-modified",
+            "vips": [],
+            "ports": [
+                {
+                    "service_port": 90,
+                    "target_port": 9090
+                },
+                {
+                    "service_port": 91
+                },
+                {
+                    "service_port": 92
+                }
+            ],
+            "loadBalancer": null,
+            "waypoint": {
+                "destination": "testnetwork/192.168.1.11"
+            }
+        },
+        {
+            "name": "service-3-modified",
+            "namespace": "ns",
+            "hostname": "hostname-3-modified",
+            "vips": [],
+            "ports": [
+                {
+                    "service_port": 90,
+                    "target_port": 9090
+                },
+                {
+                    "service_port": 91
+                },
+                {
+                    "service_port": 92
+                }
+            ],
+            "loadBalancer": null,
+            "waypoint": {
+                "destination": "testnetwork/192.168.1.11"
+            }
+        },
+        {
+            "name": "service-4-modified",
+            "namespace": "ns",
+            "hostname": "hostname-4-modified",
+            "vips": [],
+            "ports": [
+                {
+                    "service_port": 90,
+                    "target_port": 9090
+                },
+                {
+                    "service_port": 91
+                },
+                {
+                    "service_port": 92
+                }
+            ],
+            "loadBalancer": null,
+            "waypoint": {
+                "destination": "testnetwork/192.168.1.11"
+            }
+        },
+        {
+            "name": "service-5",
+            "namespace": "ns",
+            "hostname": "hostname-5",
+            "vips": [],
+            "ports": [
+                {
+                    "service_port": 80,
+                    "target_port": 8080
+                },
+                {
+                    "service_port": 81
+                },
+                {
+                    "service_port": 82
+                }
+            ],
+            "loadBalancer": null,
+            "waypoint": {
+                "destination": "testnetwork/192.168.1.11"
+            }
+        },
+        {
+            "name": "service-6",
+            "namespace": "ns",
+            "hostname": "hostname-6",
+            "vips": [],
+            "ports": [
+                {
+                    "service_port": 80,
+                    "target_port": 8080
+                },
+                {
+                    "service_port": 81
+                },
+                {
+                    "service_port": 82
+                }
+            ],
+            "loadBalancer": null,
+            "waypoint": {
+                "destination": "testnetwork/192.168.1.11"
+            }
+        },
+        {
+            "name": "service-7",
+            "namespace": "ns",
+            "hostname": "hostname-7",
+            "vips": [],
+            "ports": [
+                {
+                    "service_port": 80,
+                    "target_port": 8080
+                },
+                {
+                    "service_port": 81
+                },
+                {
+                    "service_port": 82
+                }
+            ],
+            "loadBalancer": null,
+            "waypoint": {
+                "destination": "testnetwork/192.168.1.11"
+            }
+        },
+        {
+            "name": "service-8",
+            "namespace": "ns",
+            "hostname": "hostname-8",
+            "vips": [],
+            "ports": [
+                {
+                    "service_port": 80,
+                    "target_port": 8080
+                },
+                {
+                    "service_port": 81
+                },
+                {
+                    "service_port": 82
+                }
+            ],
+            "loadBalancer": null,
+            "waypoint": {
+                "destination": "testnetwork/192.168.1.11"
+            }
+        },
+        {
+            "name": "service-9",
+            "namespace": "ns",
+            "hostname": "hostname-9",
+            "vips": [],
+            "ports": [
+                {
+                    "service_port": 80,
+                    "target_port": 8080
+                },
+                {
+                    "service_port": 81
+                },
+                {
+                    "service_port": 82
+                }
+            ],
+            "loadBalancer": null,
+            "waypoint": {
+                "destination": "testnetwork/192.168.1.11"
+            }
+        }
+    ],
+    "policies": [
+        {
+            "name": "policy",
+            "namespace": "ns",
+            "scope": "GLOBAL",
+            "action": "ALLOW",
+            "rules": null
+        }
+    ]
+}
\ No newline at end of file
diff --git a/pkg/status/testdata/workload_configdump_original_sorted.json b/pkg/status/testdata/workload_configdump_original_sorted.json
new file mode 100644
index 00000000..40834898
--- /dev/null
+++ b/pkg/status/testdata/workload_configdump_original_sorted.json
@@ -0,0 +1,495 @@
+{
+    "workloads": [
+        {
+            "uid": "cluster0//Pod/ns/workload-0",
+            "addresses": [
+                "1.2.3.4"
+            ],
+            "waypoint": "testnetwork/192.168.1.10",
+            "protocol": "NONE",
+            "name": "workload-0",
+            "namespace": "ns",
+            "serviceAccount": "",
+            "workloadName": "name",
+            "workloadType": "POD",
+            "canonicalName": "foo",
+            "canonicalRevision": "latest",
+            "clusterId": "cluster0",
+            "locality": {},
+            "node": "",
+            "network": "testnetwork",
+            "status": "HEALTHY",
+            "applicationTunnel": {
+                "protocol": ""
+            },
+            "services": [
+                "ns/hostname"
+            ]
+        },
+        {
+            "uid": "cluster0//Pod/ns/workload-1",
+            "addresses": [
+                "1.2.3.4"
+            ],
+            "waypoint": "testnetwork/192.168.1.10",
+            "protocol": "NONE",
+            "name": "workload-1",
+            "namespace": "ns",
+            "serviceAccount": "",
+            "workloadName": "name",
+            "workloadType": "POD",
+            "canonicalName": "foo",
+            "canonicalRevision": "latest",
+            "clusterId": "cluster0",
+            "locality": {},
+            "node": "",
+            "network": "testnetwork",
+            "status": "HEALTHY",
+            "applicationTunnel": {
+                "protocol": ""
+            },
+            "services": [
+                "ns/hostname"
+            ]
+        },
+        {
+            "uid": "cluster0//Pod/ns/workload-2",
+            "addresses": [
+                "1.2.3.4"
+            ],
+            "waypoint": "testnetwork/192.168.1.10",
+            "protocol": "NONE",
+            "name": "workload-2",
+            "namespace": "ns",
+            "serviceAccount": "",
+            "workloadName": "name",
+            "workloadType": "POD",
+            "canonicalName": "foo",
+            "canonicalRevision": "latest",
+            "clusterId": "cluster0",
+            "locality": {},
+            "node": "",
+            "network": "testnetwork",
+            "status": "HEALTHY",
+            "applicationTunnel": {
+                "protocol": ""
+            },
+            "services": [
+                "ns/hostname"
+            ]
+        },
+        {
+            "uid": "cluster0//Pod/ns/workload-3",
+            "addresses": [
+                "1.2.3.4"
+            ],
+            "waypoint": "testnetwork/192.168.1.10",
+            "protocol": "NONE",
+            "name": "workload-3",
+            "namespace": "ns",
+            "serviceAccount": "",
+            "workloadName": "name",
+            "workloadType": "POD",
+            "canonicalName": "foo",
+            "canonicalRevision": "latest",
+            "clusterId": "cluster0",
+            "locality": {},
+            "node": "",
+            "network": "testnetwork",
+            "status": "HEALTHY",
+            "applicationTunnel": {
+                "protocol": ""
+            },
+            "services": [
+                "ns/hostname"
+            ]
+        },
+        {
+            "uid": "cluster0//Pod/ns/workload-4",
+            "addresses": [
+                "1.2.3.4"
+            ],
+            "waypoint": "testnetwork/192.168.1.10",
+            "protocol": "NONE",
+            "name": "workload-4",
+            "namespace": "ns",
+            "serviceAccount": "",
+            "workloadName": "name",
+            "workloadType": "POD",
+            "canonicalName": "foo",
+            "canonicalRevision": "latest",
+            "clusterId": "cluster0",
+            "locality": {},
+            "node": "",
+            "network": "testnetwork",
+            "status": "HEALTHY",
+            "applicationTunnel": {
+                "protocol": ""
+            },
+            "services": [
+                "ns/hostname"
+            ]
+        },
+        {
+            "uid": "cluster0//Pod/ns/workload-5",
+            "addresses": [
+                "1.2.3.4"
+            ],
+            "waypoint": "testnetwork/192.168.1.10",
+            "protocol": "NONE",
+            "name": "workload-5",
+            "namespace": "ns",
+            "serviceAccount": "",
+            "workloadName": "name",
+            "workloadType": "POD",
+            "canonicalName": "foo",
+            "canonicalRevision": "latest",
+            "clusterId": "cluster0",
+            "locality": {},
+            "node": "",
+            "network": "testnetwork",
+            "status": "HEALTHY",
+            "applicationTunnel": {
+                "protocol": ""
+            },
+            "services": [
+                "ns/hostname"
+            ]
+        },
+        {
+            "uid": "cluster0//Pod/ns/workload-6",
+            "addresses": [
+                "1.2.3.4"
+            ],
+            "waypoint": "testnetwork/192.168.1.10",
+            "protocol": "NONE",
+            "name": "workload-6",
+            "namespace": "ns",
+            "serviceAccount": "",
+            "workloadName": "name",
+            "workloadType": "POD",
+            "canonicalName": "foo",
+            "canonicalRevision": "latest",
+            "clusterId": "cluster0",
+            "locality": {},
+            "node": "",
+            "network": "testnetwork",
+            "status": "HEALTHY",
+            "applicationTunnel": {
+                "protocol": ""
+            },
+            "services": [
+                "ns/hostname"
+            ]
+        },
+        {
+            "uid": "cluster0//Pod/ns/workload-7",
+            "addresses": [
+                "1.2.3.4"
+            ],
+            "waypoint": "testnetwork/192.168.1.10",
+            "protocol": "NONE",
+            "name": "workload-7",
+            "namespace": "ns",
+            "serviceAccount": "",
+            "workloadName": "name",
+            "workloadType": "POD",
+            "canonicalName": "foo",
+            "canonicalRevision": "latest",
+            "clusterId": "cluster0",
+            "locality": {},
+            "node": "",
+            "network": "testnetwork",
+            "status": "HEALTHY",
+            "applicationTunnel": {
+                "protocol": ""
+            },
+            "services": [
+                "ns/hostname"
+            ]
+        },
+        {
+            "uid": "cluster0//Pod/ns/workload-8",
+            "addresses": [
+                "1.2.3.4"
+            ],
+            "waypoint": "testnetwork/192.168.1.10",
+            "protocol": "NONE",
+            "name": "workload-8",
+            "namespace": "ns",
+            "serviceAccount": "",
+            "workloadName": "name",
+            "workloadType": "POD",
+            "canonicalName": "foo",
+            "canonicalRevision": "latest",
+            "clusterId": "cluster0",
+            "locality": {},
+            "node": "",
+            "network": "testnetwork",
+            "status": "HEALTHY",
+            "applicationTunnel": {
+                "protocol": ""
+            },
+            "services": [
+                "ns/hostname"
+            ]
+        },
+        {
+            "uid": "cluster0//Pod/ns/workload-9",
+            "addresses": [
+                "1.2.3.4"
+            ],
+            "waypoint": "testnetwork/192.168.1.10",
+            "protocol": "NONE",
+            "name": "workload-9",
+            "namespace": "ns",
+            "serviceAccount": "",
+            "workloadName": "name",
+            "workloadType": "POD",
+            "canonicalName": "foo",
+            "canonicalRevision": "latest",
+            "clusterId": "cluster0",
+            "locality": {},
+            "node": "",
+            "network": "testnetwork",
+            "status": "HEALTHY",
+            "applicationTunnel": {
+                "protocol": ""
+            },
+            "services": [
+                "ns/hostname"
+            ]
+        }
+    ],
+    "services": [
+        {
+            "name": "service-0",
+            "namespace": "ns",
+            "hostname": "hostname-0",
+            "vips": [],
+            "ports": [
+                {
+                    "service_port": 80,
+                    "target_port": 8080
+                },
+                {
+                    "service_port": 81
+                },
+                {
+                    "service_port": 82
+                }
+            ],
+            "loadBalancer": null,
+            "waypoint": {
+                "destination": "testnetwork/192.168.1.11"
+            }
+        },
+        {
+            "name": "service-1",
+            "namespace": "ns",
+            "hostname": "hostname-1",
+            "vips": [],
+            "ports": [
+                {
+                    "service_port": 80,
+                    "target_port": 8080
+                },
+                {
+                    "service_port": 81
+                },
+                {
+                    "service_port": 82
+                }
+            ],
+            "loadBalancer": null,
+            "waypoint": {
+                "destination": "testnetwork/192.168.1.11"
+            }
+        },
+        {
+            "name": "service-2",
+            "namespace": "ns",
+            "hostname": "hostname-2",
+            "vips": [],
+            "ports": [
+                {
+                    "service_port": 80,
+                    "target_port": 8080
+                },
+                {
+                    "service_port": 81
+                },
+                {
+                    "service_port": 82
+                }
+            ],
+            "loadBalancer": null,
+            "waypoint": {
+                "destination": "testnetwork/192.168.1.11"
+            }
+        },
+        {
+            "name": "service-3",
+            "namespace": "ns",
+            "hostname": "hostname-3",
+            "vips": [],
+            "ports": [
+                {
+                    "service_port": 80,
+                    "target_port": 8080
+                },
+                {
+                    "service_port": 81
+                },
+                {
+                    "service_port": 82
+                }
+            ],
+            "loadBalancer": null,
+            "waypoint": {
+                "destination": "testnetwork/192.168.1.11"
+            }
+        },
+        {
+            "name": "service-4",
+            "namespace": "ns",
+            "hostname": "hostname-4",
+            "vips": [],
+            "ports": [
+                {
+                    "service_port": 80,
+                    "target_port": 8080
+                },
+                {
+                    "service_port": 81
+                },
+                {
+                    "service_port": 82
+                }
+            ],
+            "loadBalancer": null,
+            "waypoint": {
+                "destination": "testnetwork/192.168.1.11"
+            }
+        },
+        {
+            "name": "service-5",
+            "namespace": "ns",
+            "hostname": "hostname-5",
+            "vips": [],
+            "ports": [
+                {
+                    "service_port": 80,
+                    "target_port": 8080
+                },
+                {
+                    "service_port": 81
+                },
+                {
+                    "service_port": 82
+                }
+            ],
+            "loadBalancer": null,
+            "waypoint": {
+                "destination": "testnetwork/192.168.1.11"
+            }
+        },
+        {
+            "name": "service-6",
+            "namespace": "ns",
+            "hostname": "hostname-6",
+            "vips": [],
+            "ports": [
+                {
+                    "service_port": 80,
+                    "target_port": 8080
+                },
+                {
+                    "service_port": 81
+                },
+                {
+                    "service_port": 82
+                }
+            ],
+            "loadBalancer": null,
+            "waypoint": {
+                "destination": "testnetwork/192.168.1.11"
+            }
+        },
+        {
+            "name": "service-7",
+            "namespace": "ns",
+            "hostname": "hostname-7",
+            "vips": [],
+            "ports": [
+                {
+                    "service_port": 80,
+                    "target_port": 8080
+                },
+                {
+                    "service_port": 81
+                },
+                {
+                    "service_port": 82
+                }
+            ],
+            "loadBalancer": null,
+            "waypoint": {
+                "destination": "testnetwork/192.168.1.11"
+            }
+        },
+        {
+            "name": "service-8",
+            "namespace": "ns",
+            "hostname": "hostname-8",
+            "vips": [],
+            "ports": [
+                {
+                    "service_port": 80,
+                    "target_port": 8080
+                },
+                {
+                    "service_port": 81
+                },
+                {
+                    "service_port": 82
+                }
+            ],
+            "loadBalancer": null,
+            "waypoint": {
+                "destination": "testnetwork/192.168.1.11"
+            }
+        },
+        {
+            "name": "service-9",
+            "namespace": "ns",
+            "hostname": "hostname-9",
+            "vips": [],
+            "ports": [
+                {
+                    "service_port": 80,
+                    "target_port": 8080
+                },
+                {
+                    "service_port": 81
+                },
+                {
+                    "service_port": 82
+                }
+            ],
+            "loadBalancer": null,
+            "waypoint": {
+                "destination": "testnetwork/192.168.1.11"
+            }
+        }
+    ],
+    "policies": [
+        {
+            "name": "policy",
+            "namespace": "ns",
+            "scope": "GLOBAL",
+            "action": "ALLOW",
+            "rules": null
+        }
+    ]
+}
\ No newline at end of file
diff --git a/test/unittest/workload/Makefile b/test/unittest/workload/Makefile
deleted file mode 100644
index 1b1595df..00000000
--- a/test/unittest/workload/Makefile
+++ /dev/null
@@ -1,27 +0,0 @@
-CFLAGS += -g3 -Wall -fPIC -I. -D__TARGET_ARCH_x86_64 -D__x86_64__ -D_GNU_SOURCE
-CFLAGS += -isystem /usr/include
-LIBS = bpf
-
-WORKLOAD_DIR = ../../../bpf/kmesh/workload
-TEST_DIR = .
-INCLUDE_DIR = $(WORKLOAD_DIR)/../../include
-
-FLAGS += -I$(WORKLOAD_DIR) -I../../../bpf/kmesh/workload/include/ctx -I../../../bpf/kmesh/workload/include/ -I../../../bpf/probes/ -I$(INCLUDE_DIR)
-
-all: xdp_test
-
-xdp_test: $(TEST_DIR)/xdp.bpf.o $(TEST_DIR)/xdp_test.skel.h
-	gcc $(CFLAGS) $(FLAGS) -include /usr/include/errno.h -o $(TEST_DIR)/xdp_test $(TEST_DIR)/xdp_test.c -l$(LIBS)
-
-$(TEST_DIR)/xdp.bpf.o: $(WORKLOAD_DIR)/xdp.c
-	clang -target bpf $(CFLAGS) $(FLAGS) -O2 -g -c $< -o $@
-
-$(TEST_DIR)/xdp_test.skel.h: $(TEST_DIR)/xdp.bpf.o
-	bpftool gen skeleton $< > $@
-
-.PHONY: clean
-clean:
-	rm -rf $(TEST_DIR)/xdp.bpf.o
-	rm -rf $(TEST_DIR)/xdp_test.skel.h 
-	rm -rf $(TEST_DIR)/xdp_test
-	rm -rf preprocessed_output.c
\ No newline at end of file
diff --git a/test/unittest/workload/common.h b/test/unittest/workload/common.h
deleted file mode 100644
index 83385a5a..00000000
--- a/test/unittest/workload/common.h
+++ /dev/null
@@ -1,160 +0,0 @@
-#ifndef __TEST_COMMON_H
-#define __TEST_COMMON_H
-
-#include <stdio.h>
-#include <assert.h>
-#include <errno.h>
-#include <string.h>
-#include <unistd.h>
-#include <time.h>
-// Test result codes
-#define TEST_PASS  0
-#define TEST_FAIL  1
-#define TEST_SKIP  2
-#define TEST_ERROR 3
-
-// Coverage related paths
-#define COVERAGE_PROG_PIN_DIR "/sys/fs/bpf/prog"
-#define COVERAGE_MAP_PIN_DIR  "/sys/fs/bpf/map"
-#define COVERAGE_BLOCK_LIST   "/tmp/block.list"
-#define COVERAGE_OUTPUT       "/tmp/coverage.html"
-
-#define MAX_SUBTESTS 64
-
-typedef enum {
-    TEST_STATUS_NONE = 0,
-    TEST_STATUS_RUNNING,
-    TEST_STATUS_COMPLETED,
-    TEST_STATUS_FAILED,
-    TEST_STATUS_SKIPPED
-} test_status_t;
-
-typedef struct {
-    const char *name;
-    test_status_t status;
-    int result;
-    const char *message;
-    double duration; // Test execution time in seconds
-} test_context_t;
-
-// Global test state
-typedef struct {
-    const char *suite_name;
-    test_context_t subtests[MAX_SUBTESTS];
-    int subtest_count;
-    int passed_count;
-    int failed_count;
-    int skipped_count;
-} test_suite_t;
-
-static test_suite_t current_suite = {0};
-static test_context_t *current_test_ctx = NULL;
-
-static inline void test_init(const char *test_name)
-{
-    printf("\n=== Starting test suite: %s ===\n", test_name);
-    current_suite.suite_name = test_name;
-    current_suite.subtest_count = 0;
-    current_suite.passed_count = 0;
-    current_suite.failed_count = 0;
-    current_suite.skipped_count = 0;
-}
-
-static inline void test_finish(void)
-{
-    printf("\n=== Test suite summary: %s ===\n", current_suite.suite_name);
-    printf("Total tests: %d\n", current_suite.subtest_count);
-    printf("  Passed:  %d\n", current_suite.passed_count);
-    printf("  Failed:  %d\n", current_suite.failed_count);
-    printf("  Skipped: %d\n", current_suite.skipped_count);
-
-    if (current_suite.subtest_count > 0) {
-        printf("\nDetailed results:\n");
-        for (int i = 0; i < current_suite.subtest_count; i++) {
-            test_context_t *test = &current_suite.subtests[i];
-            const char *status_str = test->result == TEST_PASS ? "PASS" :
-                                     test->result == TEST_SKIP ? "SKIP" :
-                                     test->result == TEST_FAIL ? "FAIL" :
-                                                                 "ERROR";
-
-            printf("  %s: %s (%.3fs)", test->name, status_str, test->duration);
-            if (test->message) {
-                printf(" - %s", test->message);
-            }
-            printf("\n");
-        }
-    }
-
-    printf("\n=== Final result: %s ===\n\n", current_suite.failed_count > 0 ? "FAILED" : "PASSED");
-}
-
-#define TEST(test_name, fn)                                                                                            \
-    do {                                                                                                               \
-        const char *_test_name = test_name;                                                                            \
-        if (current_suite.subtest_count >= MAX_SUBTESTS) {                                                             \
-            printf("ERROR: Too many subtests\n");                                                                      \
-            break;                                                                                                     \
-        }                                                                                                              \
-        test_context_t *_test_ctx = &current_suite.subtests[current_suite.subtest_count++];                            \
-        _test_ctx->name = _test_name;                                                                                  \
-        _test_ctx->status = TEST_STATUS_RUNNING;                                                                       \
-        _test_ctx->result = TEST_PASS;                                                                                 \
-        _test_ctx->message = NULL;                                                                                     \
-        current_test_ctx = _test_ctx; /* Set current test context */                                                   \
-        struct timespec _start_time, _end_time;                                                                        \
-        clock_gettime(CLOCK_MONOTONIC, &_start_time);                                                                  \
-        test_log("\n--- Starting test: %s ---", _test_name);                                                           \
-        fn();                                                                                                          \
-        clock_gettime(CLOCK_MONOTONIC, &_end_time);                                                                    \
-        _test_ctx->duration =                                                                                          \
-            (_end_time.tv_sec - _start_time.tv_sec) + (_end_time.tv_nsec - _start_time.tv_nsec) / 1e9;                 \
-        _test_ctx->status = TEST_STATUS_COMPLETED;                                                                     \
-        switch (_test_ctx->result) {                                                                                   \
-        case TEST_PASS:                                                                                                \
-            current_suite.passed_count++;                                                                              \
-            break;                                                                                                     \
-        case TEST_FAIL:                                                                                                \
-            current_suite.failed_count++;                                                                              \
-            break;                                                                                                     \
-        case TEST_SKIP:                                                                                                \
-            current_suite.skipped_count++;                                                                             \
-            break;                                                                                                     \
-        }                                                                                                              \
-        test_log(                                                                                                      \
-            "--- Test %s: %s ---\n",                                                                                   \
-            _test_ctx->name,                                                                                           \
-            _test_ctx->result == TEST_PASS ? "PASSED" :                                                                \
-            _test_ctx->result == TEST_SKIP ? "SKIPPED" :                                                               \
-                                             "FAILED");                                                                \
-        current_test_ctx = NULL; /* Clear current test context */                                                      \
-    } while (0)
-
-#define SKIP_SUB_TEST(msg)                                                                                             \
-    do {                                                                                                               \
-        test_log("Skipping test: %s", msg);                                                                            \
-        current_test_ctx->result = TEST_SKIP;                                                                          \
-        current_test_ctx->message = msg;                                                                               \
-        break;                                                                                                         \
-    } while (0)
-
-#define test_assert(cond, msg)                                                                                         \
-    do {                                                                                                               \
-        if (!(cond)) {                                                                                                 \
-            test_log("Assert failed: %s", msg);                                                                        \
-            test_log("At %s:%d", __FILE__, __LINE__);                                                                  \
-            if (current_test_ctx) {                                                                                    \
-                current_test_ctx->result = TEST_FAIL;                                                                  \
-                current_test_ctx->message = msg;                                                                       \
-            }                                                                                                          \
-            return;                                                                                                    \
-        }                                                                                                              \
-    } while (0)
-
-// Test logging
-#define test_log(fmt, ...) printf(fmt "\n", ##__VA_ARGS__)
-
-// Test setup/teardown helpers
-typedef void (*test_setup_fn)(void);
-typedef void (*test_teardown_fn)(void);
-
-#endif /* __TEST_COMMON_H */
\ No newline at end of file
diff --git a/test/unittest/workload/run_tests.sh b/test/unittest/workload/run_tests.sh
deleted file mode 100644
index 62de9d6c..00000000
--- a/test/unittest/workload/run_tests.sh
+++ /dev/null
@@ -1,61 +0,0 @@
-#!/bin/bash
-
-# Exit on error
-set -e
-
-# Ensure running as root
-if [ "$EUID" -ne 0 ]; then
-	echo "Please run as root"
-	exit 1
-fi
-
-# Set memory limits
-ulimit -l unlimited
-
-# Create necessary directories
-mkdir -p /sys/fs/bpf/prog
-mkdir -p /sys/fs/bpf/map
-mkdir -p /tmp/coverage
-
-# Define paths
-ELF_FILE="xdp.bpf.o"
-PROG_PIN_DIR="/sys/fs/bpf/prog"
-MAP_PIN_DIR="/sys/fs/bpf/map"
-BLOCK_LIST="/tmp/coverage/block.list"
-COVERAGE_OUTPUT="/tmp/coverage/coverage.html"
-
-# Clean up old pins
-rm -rf ${PROG_PIN_DIR}/* ${MAP_PIN_DIR}/* || true
-
-# Clean and rebuild
-echo "Cleaning and rebuilding..."
-make clean
-make
-
-# 1. Load and instrument BPF program
-echo "Loading and instrumenting BPF program..."
-coverbee load \
-	--elf=${ELF_FILE} \
-	--prog-pin-dir=${PROG_PIN_DIR} \
-	--map-pin-dir=${MAP_PIN_DIR} \
-	--block-list=${BLOCK_LIST} \
-	--log=/tmp/coverage/coverbee.log
-
-# 2. Run tests
-echo "Running tests..."
-./xdp_test
-
-# 3. Collect coverage data
-echo "Collecting coverage data..."
-coverbee cover \
-	--map-pin-dir=${MAP_PIN_DIR} \
-	--block-list=${BLOCK_LIST} \
-	--output=${COVERAGE_OUTPUT} \
-	--format=html
-
-# 4. Cleanup
-echo "Cleaning up..."
-rm -rf ${PROG_PIN_DIR}/*
-rm -rf ${MAP_PIN_DIR}/*
-
-echo "Coverage report generated at: ${COVERAGE_OUTPUT}"
diff --git a/test/unittest/workload/xdp_test.c b/test/unittest/workload/xdp_test.c
deleted file mode 100644
index 104d4cd6..00000000
--- a/test/unittest/workload/xdp_test.c
+++ /dev/null
@@ -1,310 +0,0 @@
-#include <errno.h>
-#include <bpf/bpf.h>
-#include <bpf/libbpf.h>
-#include <stdio.h>
-#include <assert.h>
-#include <arpa/inet.h>
-#include <netinet/in.h>
-#include <sys/socket.h>
-#include <linux/if_ether.h>
-#include <linux/ip.h>
-#include <linux/ipv6.h>
-#include <linux/tcp.h>
-#include "xdp_test.skel.h"
-#include <asm/unistd.h>
-
-#include "common.h"
-
-// Add missing includes and definitions
-#include <unistd.h>
-#include <linux/if_xdp.h>
-#include <linux/if.h>
-#include <linux/bpf.h>
-
-#define XDP_PACKET_HEADROOM 256
-#define SKB_DATA_ALIGN(len) (((len) + (64 - 1)) & ~(64 - 1))
-#define AUTH_PASS           0
-#define AUTH_FORBID         1
-
-// Define skb_shared_info structure (simplified version)
-struct skb_shared_info {
-    unsigned char pad[256]; // Simplified version
-};
-
-// Define xdp_buff structure
-struct xdp_buff {
-    void *data;
-    void *data_end;
-    void *data_meta;
-    void *data_hard_start;
-    unsigned int frame_sz;
-};
-
-#define PACKET_SIZE 100
-
-struct xdp_bpf *skel;
-int prog_fd;
-
-static int run_xdp_test(void *packet, size_t size)
-{
-    // Constants from kernel implementation
-    unsigned int headroom = XDP_PACKET_HEADROOM; // 256
-    unsigned int tailroom = SKB_DATA_ALIGN(sizeof(struct skb_shared_info));
-    unsigned int max_data_sz = 4096 - headroom - tailroom;
-
-    if (size > max_data_sz) {
-        test_log("Packet size too large: %zu > %u", size, max_data_sz);
-        return -1;
-    }
-
-    // Allocate memory for the full frame
-    void *data;
-    size_t frame_size = headroom + size + tailroom;
-    if (posix_memalign(&data, getpagesize(), frame_size) != 0) {
-        test_log("Failed to allocate memory for test data");
-        return -1;
-    }
-
-    // Initialize the memory to zero
-    memset(data, 0, frame_size);
-
-    // Copy packet data to the correct location (after headroom)
-    memcpy(data + headroom, packet, size);
-    struct xdp_buff xdp = {
-        .data_hard_start = data,
-        .data = data + headroom,
-        .data_meta = data + headroom,
-        .data_end = data + headroom + size,
-        .frame_sz = frame_size,
-    };
-
-    test_log("Debug info:");
-    test_log("  frame_size: %zu", frame_size);
-    test_log("  headroom: %u", headroom);
-    test_log("  data_size: %zu", size);
-    test_log("  tailroom: %u", tailroom);
-    test_log("  hard_start: %p", xdp.data_hard_start);
-    test_log("  data: %p", xdp.data);
-    test_log("  data_end: %p", xdp.data_end);
-    test_log("  frame_sz: %u", xdp.frame_sz);
-
-    struct bpf_test_run_opts opts = {
-        .sz = sizeof(struct bpf_test_run_opts),
-        .data_in = data + headroom,
-        .data_out = data + headroom,
-        .data_size_in = size,
-        .data_size_out = size,
-        // XDP programs don't use ctx_in/ctx_out according to kernel code
-        .ctx_in = NULL,
-        .ctx_out = NULL,
-        .ctx_size_in = 0,
-        .ctx_size_out = 0,
-        .repeat = 1,
-    };
-
-    int ret = bpf_prog_test_run_opts(prog_fd, &opts);
-    if (ret != 0) {
-        test_log("bpf_prog_test_run_opts failed: %d (errno: %d - %s)", ret, errno, strerror(errno));
-        test_log("Data size: %u, Frame size: %zu", opts.data_size_in, frame_size);
-        test_log("Prog FD: %d", prog_fd);
-        test_log("Retval: %d", opts.retval);
-    } else {
-        test_log("Test run successful, retval: %d", opts.retval);
-    }
-
-    free(data);
-    memcpy(packet, opts.data_out, opts.data_size_out);
-    return ret;
-}
-
-void bpf_offload()
-{
-    xdp_bpf__destroy(skel);
-}
-
-void test_packet_parsing()
-{
-    unsigned char packet[PACKET_SIZE] = {0};
-    struct ethhdr *eth = (struct ethhdr *)packet;
-    struct iphdr *ip = (struct iphdr *)(packet + sizeof(struct ethhdr));
-    struct tcphdr *tcp = (struct tcphdr *)(packet + sizeof(struct ethhdr) + sizeof(struct iphdr));
-
-    // Set minimum packet size
-    size_t min_size = sizeof(struct ethhdr) + sizeof(struct iphdr) + sizeof(struct tcphdr);
-    test_assert(PACKET_SIZE >= min_size, "PACKET_SIZE too small");
-
-    // Fill in packet headers
-    eth->h_proto = htons(ETH_P_IP);
-    memset(eth->h_source, 0x12, ETH_ALEN);
-    memset(eth->h_dest, 0x34, ETH_ALEN);
-
-    ip->version = 4;
-    ip->ihl = 5;
-    ip->protocol = IPPROTO_TCP;
-    ip->tot_len = htons(sizeof(struct iphdr) + sizeof(struct tcphdr));
-    ip->daddr = htonl(0x08080808); // 8.8.8.8
-    ip->saddr = htonl(0x0A000001); // 10.0.0.1
-
-    tcp->source = htons(12345);
-    tcp->dest = htons(80);
-    tcp->doff = 5; // 20 bytes TCP header
-
-    test_log("Packet size: %u", PACKET_SIZE);
-    test_log("Headers size: %u", min_size);
-
-    int err = run_xdp_test(packet, PACKET_SIZE);
-    test_log("err = %d", err);
-    test_assert(err == 0, "run_xdp_test failed");
-}
-
-void bpf_load()
-{
-    int err;
-
-    skel = xdp_bpf__open();
-    test_assert(skel != NULL, "Failed to open BPF skeleton");
-
-    // Set XDP program type
-    bpf_program__set_type(skel->progs.xdp_shutdown, BPF_PROG_TYPE_XDP);
-
-    err = xdp_bpf__load(skel);
-    test_assert(err == 0, "Failed to load BPF skeleton");
-
-    prog_fd = bpf_program__fd(skel->progs.xdp_shutdown);
-    test_assert(prog_fd >= 0, "Failed to get program FD");
-
-    // Get program type and expected test parameters
-    struct bpf_prog_info info = {};
-    __u32 info_len = sizeof(info);
-    err = bpf_obj_get_info_by_fd(prog_fd, &info, &info_len);
-    test_assert(err == 0, "Failed to get program info");
-
-    test_log("Successfully loaded XDP program, prog_fd = %d, type = %u", prog_fd, info.type);
-}
-
-void test_ip_version_check()
-{
-    unsigned char packet[PACKET_SIZE] = {0};
-    struct ethhdr *eth = (struct ethhdr *)packet;
-    struct iphdr *ip = (struct iphdr *)(packet + sizeof(struct ethhdr));
-
-    eth->h_proto = htons(ETH_P_IP);
-    ip->version = 5; // Invalid IP version
-
-    int err = run_xdp_test(packet, PACKET_SIZE);
-    test_assert(err == 0, "run_xdp_test failed");
-}
-
-void test_tuple_extraction()
-{
-    unsigned char packet[PACKET_SIZE] = {0};
-    struct ethhdr *eth = (struct ethhdr *)packet;
-    struct iphdr *ip = (struct iphdr *)(packet + sizeof(struct ethhdr));
-    struct tcphdr *tcp = (struct tcphdr *)(packet + sizeof(struct ethhdr) + sizeof(struct iphdr));
-
-    eth->h_proto = htons(ETH_P_IP);
-    ip->version = 4;
-    ip->ihl = 5;
-    ip->protocol = IPPROTO_TCP;
-    ip->saddr = inet_addr("192.168.1.1");
-    ip->daddr = inet_addr("192.168.1.2");
-    tcp->source = htons(12345);
-    tcp->dest = htons(80);
-
-    int err = run_xdp_test(packet, PACKET_SIZE);
-    test_assert(err == 0, "run_xdp_test failed");
-}
-
-void test_connection_shutdown()
-{
-    unsigned char packet[PACKET_SIZE] = {0};
-    struct ethhdr *eth = (struct ethhdr *)packet;
-    struct iphdr *ip = (struct iphdr *)(packet + sizeof(struct ethhdr));
-    struct tcphdr *tcp = (struct tcphdr *)(packet + sizeof(struct ethhdr) + sizeof(struct iphdr));
-
-    // Set minimum packet size
-    size_t min_size = sizeof(struct ethhdr) + sizeof(struct iphdr) + sizeof(struct tcphdr);
-    test_assert(PACKET_SIZE >= min_size, "PACKET_SIZE too small");
-
-    // Fill in ethernet header
-    eth->h_proto = htons(ETH_P_IP);
-    memset(eth->h_source, 0x12, ETH_ALEN);
-    memset(eth->h_dest, 0x34, ETH_ALEN);
-
-    // Fill in IP header
-    ip->version = 4;
-    ip->ihl = 5;
-    ip->protocol = IPPROTO_TCP;
-    ip->tot_len = htons(sizeof(struct iphdr) + sizeof(struct tcphdr));
-    ip->saddr = inet_addr("192.168.1.1");
-    ip->daddr = inet_addr("192.168.1.2");
-
-    // Fill in TCP header
-    tcp->source = htons(12345);
-    tcp->dest = htons(80);
-    tcp->doff = 5; // 20 bytes TCP header
-    tcp->syn = 1;  // SYN packet
-    tcp->rst = 0;  // Make sure RST is not set initially
-
-    // Add the connection to the auth map to simulate a connection that should be shut down
-    struct bpf_sock_tuple tuple = {
-        .ipv4 =
-            {
-                .saddr = ip->saddr,
-                .daddr = ip->daddr,
-                .sport = tcp->source,
-                .dport = tcp->dest,
-            },
-    };
-    __u32 value = AUTH_FORBID; // Use AUTH_FORBID value
-
-    // Update the map
-    int err = bpf_map_update_elem(bpf_map__fd(skel->maps.map_of_auth_result), &tuple, &value, BPF_ANY);
-    test_assert(err == 0, "Failed to update map");
-
-    // Log test details
-    test_log("Testing connection shutdown:");
-    test_log("  Source IP: %s", inet_ntoa((struct in_addr){.s_addr = ip->saddr}));
-    test_log("  Dest IP: %s", inet_ntoa((struct in_addr){.s_addr = ip->daddr}));
-    test_log("  Source Port: %d", ntohs(tcp->source));
-    test_log("  Dest Port: %d", ntohs(tcp->dest));
-    test_log("  Map value: %u", value);
-
-    // Run the XDP program
-    int err1 = run_xdp_test(packet, PACKET_SIZE);
-    test_assert(err1 == 0, "XDP test failed");
-
-    // Check if the packet was modified correctly
-    struct tcphdr *modified_tcp = (struct tcphdr *)(packet + sizeof(struct ethhdr) + sizeof(struct iphdr));
-    test_log("TCP flags after XDP:");
-    test_log("  RST: %d", modified_tcp->rst);
-    test_log("  SYN: %d", modified_tcp->syn);
-    test_log("  FIN: %d", modified_tcp->fin);
-    test_log("  PSH: %d", modified_tcp->psh);
-    test_log("  ACK: %d", modified_tcp->ack);
-
-    // Verify that RST flag was set
-    test_assert(modified_tcp->rst == 1, "RST flag not set");
-    test_assert(modified_tcp->syn == 0, "SYN flag not cleared"); // SYN should be cleared
-    test_assert(modified_tcp->fin == 0, "FIN flag not cleared"); // FIN should be cleared
-    test_assert(modified_tcp->psh == 0, "PSH flag not cleared"); // PSH should be cleared
-    test_assert(modified_tcp->ack == 0, "ACK flag not cleared"); // ACK should be cleared
-
-    // Clean up the map entry
-    bpf_map_delete_elem(bpf_map__fd(skel->maps.map_of_auth_result), &tuple);
-}
-
-int main()
-{
-    test_init("xdp_test");
-
-    TEST("BPF Program Load", bpf_load);
-    TEST("Packet Parsing", test_packet_parsing);
-    TEST("IP Version Check", test_ip_version_check);
-    TEST("Tuple Extraction", test_tuple_extraction);
-    TEST("Connection Shutdown", test_connection_shutdown);
-    TEST("BPF Program Cleanup", bpf_offload);
-
-    test_finish();
-    return current_suite.failed_count > 0 ? 1 : 0;
-}
\ No newline at end of file