b.WriteString("MonitoringPort: " + fmt.Sprint(c.MonitoringPort) + "\n")
	b.WriteString("ZtunnelUDSAddress: " + fmt.Sprint(c.ZtunnelUDSAddress) + "\n")

	b.WriteString("AmbientEnabled: " + fmt.Sprint(c.AmbientEnabled) + "\n")
	b.WriteString("AmbientDNSCapture: " + fmt.Sprint(c.AmbientDNSCapture) + "\n")
	b.WriteString("AmbientIPv6: " + fmt.Sprint(c.AmbientIPv6) + "\n")
	b.WriteString("AmbientRedirectTPROXY: " + fmt.Sprint(c.AmbientTPROXYRedirection) + "\n")

		},
		{
			version: versionInvalid1,
			errMsg:  fmt.Errorf("could not parse Malformed version: %v", versionInvalid1.GitVersion),
			isValid: false,
		},
		{
			version: versionInvalid2,
			errMsg:  fmt.Errorf("could not parse Malformed version: %v", versionInvalid2.GitVersion),
			isValid: false,
		},
	}
	for i, c := range cases {
		t.Run(fmt.Sprintf("case %d %s", i, c.version), func(t *testing.T) {

	if err != nil {
		return err
	}
	if filter.Verbose {
		fmt.Fprintln(w, "NAME\tVHOST NAME\tDOMAINS\tMATCH\tVIRTUAL SERVICE")
	} else {
		fmt.Fprintln(w, "NAME\tVIRTUAL HOSTS")
	}
	for _, route := range routes {
		if filter.Verify(route) {
			if includeConfigType {
				route.Name = fmt.Sprintf("route/%s", route.Name)
			}
			if filter.Verbose {

		if nsMatched && podMatched {
			if nsLabel != "" && podLabel != "" {
				return fmt.Sprintf("Namespace label %s matches, and pod label %s matches", nsLabel, podLabel), true
			} else if nsLabel != "" {
				outMsg := fmt.Sprintf("Namespace label %s matches", nsLabel)
				if strings.Contains(nsLabel, "kubernetes.io/metadata.name") {

func (w *sdsWriter) printDiffsTabular(statuses []SecretItemDiff) error {
	if len(statuses) == 0 {
		fmt.Fprintln(w.w, "No secrets found to diff.")
		return nil
	}
	tw := new(tabwriter.Writer).Init(w.w, 0, 5, 5, ' ', 0)
	fmt.Fprintln(tw, strings.Join(secretDiffColumns, "\t"))
	for _, status := range statuses {
		fmt.Fprintf(tw, "%s\t%s\t%t\t%s\t%s\t%s\t%s\t%s\n",

	if err != nil {
		return nil, fmt.Errorf("failed to listen on unix socket %q: %v", path, err)
	}

	// Update file permission so that cni plugin has permission to access it.
	if _, err := os.Stat(path); err != nil {
		return nil, fmt.Errorf("cni listener file %q doesn't exist", path)
	}
	if err := os.Chmod(path, 0o666); err != nil {
		return nil, fmt.Errorf("failed to update %q permission", path)
	}

			if !f {
				continue
			}
			if w.Status != "Healthy" {
				continue
			}
			healthyEndpoints++
		}
		endpoints := fmt.Sprintf("%d/%d", healthyEndpoints, allEndpoints)

		waypoint := serviceWaypointName(svc, zDump.Services)
		fmt.Fprintf(w, "%v\t%v\t%v\t%v\t%v\n",
			svc.Namespace, svc.Name, strings.Join(ips, ","), waypoint, endpoints)
	}
	return w.Flush()
}

		return nil, fmt.Errorf("%s: %w", path, err)
	}

	return cniConfigMap, nil
}

// Given an unmarshalled CNI config JSON map, return the plugin list asserted as a []interface{}
func GetPlugins(cniConfigMap map[string]any) (plugins []any, err error) {
	plugins, ok := cniConfigMap["plugins"].([]any)
	if !ok {
		err = fmt.Errorf("error reading plugin list from CNI config")
		return

		return filepath.Base(confFile), nil
	}

	return "", fmt.Errorf("no valid networks found in %s", confDir)
}

// insertCNIConfig will append newCNIConfig to existingCNIConfig
func insertCNIConfig(newCNIConfig, existingCNIConfig []byte) ([]byte, error) {
	var istioMap map[string]any
	err := json.Unmarshal(newCNIConfig, &istioMap)
	if err != nil {
		return nil, fmt.Errorf("error loading Istio CNI config (JSON error): %v", err)
	}

			expectedOutput: nil,
			expectedError:  fmt.Errorf("invalid version XX, expected format like '1.0'"),
		},
		{
			revision:       "canary",
			version:        "2.0",
			expectedOutput: nil,
			expectedError:  fmt.Errorf("expected major version 1, got 2"),
		},
		{
			revision:       "canary",
			version:        "2.",
			expectedOutput: nil,
			expectedError:  fmt.Errorf("minor version is not a number: X"),
		},