if err != nil {
		return nil, err
	}
	return data, nil
}

func StableXdsStatusCommand(ctx cli.Context) *cobra.Command {
	cmd := XdsStatusCommand(ctx)
	unstableFlags := []string{"xds-via-agents", "xds-via-agents-limit"}
	cmd.PreRunE = func(cmd *cobra.Command, args []string) error {
		for _, flag := range unstableFlags {
			if cmd.PersistentFlags().Changed(flag) {

message IPAddressSpec {
  // ParentRef references the resource that an IPAddress is attached to.
  // An IPAddress must reference a parent object.
  // +required
  optional ParentReference parentRef = 1;
}

// ParentReference describes a reference to a parent object.
message ParentReference {
  // Group is the group of the object being referenced.
  // +optional
  optional string group = 1;

func (wf *PolicyFilter) Verify(pol *ZtunnelPolicy) bool {
	if wf.Namespace != "" {
		if !strings.EqualFold(pol.Namespace, wf.Namespace) {
			return false
		}
	}

	return true
}

// PrintServiceSummary prints a summary of the relevant services in the config dump to the ConfigWriter stdout
func (c *ConfigWriter) PrintPolicySummary(filter PolicyFilter) error {
	w := c.tabwriter()
	zDump := c.ztunnelDump

	}
	return promv1.NewAPI(promClient), nil
}

func metrics(promAPI promv1.API, workload string, duration time.Duration) (workloadMetrics, error) {
	parts := strings.Split(workload, ".")
	wname := parts[0]
	wns := ""
	if len(parts) > 1 {
		wns = parts[1]
	}

	rpsQuery := fmt.Sprintf(`sum(rate(%s{%s=~"%s.*", %s=~"%s.*",reporter="destination"}[%s]))`,

  // This value will be null if an APIService reports subresources but supports no operations on the parent resource
  optional k8s.io.apimachinery.pkg.apis.meta.v1.GroupVersionKind responseKind = 2;

  // scope indicates the scope of a resource, either Cluster or Namespaced
  optional string scope = 3;

var configDumpFile string

func checkCmd(ctx cli.Context) *cobra.Command {
	cmd := &cobra.Command{
		Use:   "check [<type>/]<name>[.<namespace>]",
		Short: "Check AuthorizationPolicy applied in the pod.",
		Long: `Check prints the AuthorizationPolicy applied to a pod by directly checking
the Envoy configuration of the pod. The command is especially useful for inspecting
the policy propagation from Istiod to Envoy and the final AuthorizationPolicy list merged