func (o *CentralControlPlaneOptions) ValidateControlPlaneFlags() error {
	if o.Xds != "" && o.XdsPodLabel != "" {
		return fmt.Errorf("either --xds-address or --xds-label, not both")
	}
	if o.Plaintext && o.CertDir != "" {
		return fmt.Errorf("either --plaintext or --cert-dir, not both")
	}
	return nil

				makeGateway(constants.DefaultNamespaceWaypoint, "default", true, true),
				makeGateway(constants.DefaultNamespaceWaypoint, "fake", true, true),
			},
			expectedOutFile: "all-gateway",
		},
		{
			name: "have both managed and unmanaged gateways",
			args: strings.Split("list -A", " "),
			gateways: []*gateway.Gateway{
				makeGateway("bookinfo", "default", false, true),
				makeGateway("bookinfo-invalid", "fake", true, false),

	}
	return string(prettyJSON), nil
}

func profileDump(args []string, pdArgs *profileDumpArgs, l clog.Logger) error {
	if len(args) == 1 && pdArgs.inFilenames != nil {
		return fmt.Errorf("cannot specify both profile name and filename flag")
	}

	if err := validateProfileOutputFormatFlag(pdArgs.outputFormat); err != nil {
		return err
	}

	setFlags := applyFlagAliases(make([]string, 0), pdArgs.manifestsPath, "")

  # Enable Tracing
  istioctl manifest generate --set meshConfig.enableTracing=true

  # Generate the demo profile
  istioctl manifest generate --set profile=demo

  # To override a setting that includes dots, escape them with a backslash (\).  Your shell may require enclosing quotes.

	child := &cobra.Command{
		Use: "child",
		Run: func(c *cobra.Command, args []string) {},
	}
	_ = parent.PersistentFlags().String(childFlag2, "", childFlag2)
	parent.AddCommand(child)

	// verify both parent flags and the child flag are visible by default
	parent.SetArgs([]string{"child", "--help"})
	if err := parent.Execute(); err != nil {
		t.Fatal(err)
	}
	got := out.String()
	out.Reset()

			name: "ambient mode enabled for pod",
			args: args{
				namespace: unlabelledNamespace,
				pod:       podWithAmbientEnabledLabel,
			},
			want: true,
		},
		{
			name: "ambient mode enabled for both namespace and pod",
			args: args{
				namespace: namespaceWithAmbientEnabledLabel,
				pod:       podWithAmbientEnabledLabel,
			},
			want: true,
		},
		{

	if err != nil {
		return nil, err
	}

	dal := make([]*admin.ListenersConfigDump_DynamicListener, 0)
	for _, l := range listenerDump.DynamicListeners {
		// If a listener was reloaded, it would contain both the active and draining state
		// delete the draining state for proper comparison
		l.DrainingState = nil
		if l.ActiveState != nil {
			dal = append(dal, l)
		}
	}

	_, err := client.CoreV1().
		Pods(pod.Namespace).
		Patch(
			context.Background(),
			pod.Name,
			types.MergePatchType,
			annotationPatch,
			metav1.PatchOptions{},
			// Both "pods" and "pods/status" can mutate the metadata. However, pods/status is lower privilege, so we use that instead.
			"status",
		)
	return err
}

	clearEntriesWithIP(name string, ip netip.Addr) error
	listEntriesByIP(name string) ([]netip.Addr, error)
}

// TODO this should actually create v6 and v6 subsets of type `hash:ip`, add them both to a
// superset of type `list:set` - we can then query the superset directly in iptables (with the same rule),
// and iptables will be smart enough to pick the correct underlying set (v4 or v6, based on context),

			execClientConfig: loggingConfig,
			args:             strings.Split("log details-v1-5b7f94f9bc-wp5tb --level http:yyy", " "),
			expectedString:   "unrecognized logging level: yyy",
			wantException:    true,
		},
		{ // both logger name and logging level invalid
			execClientConfig: loggingConfig,
			args:             strings.Split("log details-v1-5b7f94f9bc-wp5tb --level xxx:yyy", " "),
			expectedString:   "unrecognized logger name: xxx",