row.new('Push Information')
    + row.withPanels([
      panels.timeSeries.xdsPushes(
        'XDS Pushes', queries.xdsPushes, |||
          Rate of XDS push operations, by type. This is incremented on a per-proxy basis.
        |||
      ),
      panels.timeSeries.base(
        'Events', queries.pilotEvents, |||
          Size of each xDS push.
        |||
      ),
      panels.timeSeries.base(

  istioctl ps --xds-address istio.example.com:15012 --cert-dir ~/.istio-certs

  # Retrieve proxy status information via XDS from specific control plane in multi-control plane in-cluster configuration
  # (Select a specific control plane in an in-cluster canary Istio configuration.)
  istioctl ps --xds-label istio.io/rev=default
`,
		Aliases: []string{"ps"},

					args := []string{
						"x", "proxy-status", "--xds-via-agents", fmt.Sprintf("%s.%s", podName, namespace),
					}
					output, _, err := istioCtl.Invoke(args)
					if err != nil {
						return err
					}
					return expectSubstrings(output, "Clusters Match", "Listeners Match", "Routes Match")
				})

				// Test gRPC-based tapped XDS using istioctl.
				retry.UntilSuccessOrFail(t, func() error {

	typeTag = monitoring.CreateLabel("type")

	TotalXDSInternalErrors = monitoring.NewSum(
		"pilot_total_xds_internal_errors",
		"Total number of internal XDS errors in pilot.",
	)

	ExpiredNonce = monitoring.NewSum(
		"pilot_xds_expired_nonce",
		"Total number of XDS requests with an expired nonce.",
	)

	// pilot_total_xds_rejects should be used instead. This is for backwards compatibility
	cdsReject = monitoring.NewGauge(

// limitations under the License.

package xds

import (
	"encoding/json"
	"strconv"
	"strings"
	"time"

	core "github.com/envoyproxy/go-control-plane/envoy/config/core/v3"
	discovery "github.com/envoyproxy/go-control-plane/envoy/service/discovery/v3"

	"istio.io/istio/pilot/pkg/model"
	"istio.io/istio/pilot/pkg/networking/util"
	v3 "istio.io/istio/pilot/pkg/xds/v3"
	"istio.io/istio/pkg/env"

		Name: wasmPlugin.ResourceName,
		ConfigType: &hcm.HttpFilter_ConfigDiscovery{
			ConfigDiscovery: &core.ExtensionConfigSource{
				ConfigSource: defaultConfigSource,
				TypeUrls: []string{
					xds.WasmHTTPFilterType,
					xds.RBACHTTPFilterType,
				},
			},
		},
	}
}

func toEnvoyNetworkFilter(wasmPlugin *model.WasmPluginWrapper) *listener.Filter {
	return &listener.Filter{
		Name: wasmPlugin.ResourceName,

	v3 "istio.io/istio/pilot/pkg/xds/v3"
	"istio.io/istio/pilot/test/xds"
	"istio.io/istio/pilot/test/xdstest"
	"istio.io/istio/pkg/config"
	"istio.io/istio/pkg/config/schema/gvk"
	"istio.io/istio/pkg/ptr"
	"istio.io/istio/pkg/slices"
	"istio.io/istio/pkg/test/util/assert"
	"istio.io/istio/pkg/util/sets"
)

func TestCDS(t *testing.T) {
	s := xds.NewFakeDiscoveryServer(t, xds.FakeOptions{})

// See the License for the specific language governing permissions and
// limitations under the License.
package xds

import (
	"sync"
	"time"

	"google.golang.org/grpc/codes"
	"google.golang.org/grpc/status"

	"istio.io/istio/pilot/pkg/model"
	v3 "istio.io/istio/pilot/pkg/xds/v3"
	"istio.io/istio/pkg/monitoring"
)

var (
	typeTag    = monitoring.CreateLabel("type")

// limitations under the License.

package xds

import (
	"fmt"

	discovery "github.com/envoyproxy/go-control-plane/envoy/service/discovery/v3"
	"github.com/google/go-cmp/cmp"
	"google.golang.org/protobuf/testing/protocmp"

	"istio.io/istio/pilot/pkg/model"
	v3 "istio.io/istio/pilot/pkg/xds/v3"
	"istio.io/istio/pkg/slices"
	"istio.io/istio/pkg/util/sets"
)

      panels.timeSeries.dns('DNS Request', queries.dns, 'DNS queries recieved per instance'),
    ]),
    row.new('Operations')
    + row.withPanels([
      panels.timeSeries.base(
        'XDS', queries.ztunnelXdsConnections, |||
          Count of XDS connection terminations.
          This will typically spike every 30min for each instance.
        |||
      ),
      panels.timeSeries.base('Workload Manager', queries.workloadManager, |||