}
				}
				if tc.whURL != "" {
					if validationWhConf.URL == nil {
						t.Fatalf("expected validation URL %s, got nil", tc.whURL)
					}
					if *validationWhConf.URL != tc.whURL {
						t.Fatalf("expected validation URL %s, got %s", tc.whURL, *validationWhConf.URL)
					}
				}
				if tc.whCA != "" {
					if string(validationWhConf.CABundle) != tc.whCA {

	}
	objLabels, err := GetTemplateLabels(un)
	if err != nil {
		return err
	}
	url := fmt.Sprintf("See %s\n", url.DeploymentRequirements)
	if !labels.HasCanonicalServiceName(objLabels) || !labels.HasCanonicalServiceRevision(objLabels) {
		fmt.Fprintf(writer, "deployment %q may not provide Istio metrics and telemetry labels: %q. "+url,
			fmt.Sprintf("%s/%s:", un.GetName(), un.GetNamespace()), objLabels)
	}
	return nil
}

	})
	if err != nil {
		return nil, err
	}
	for _, whc := range webhooks.Items {
		for _, wh := range whc.Webhooks {
			if wh.ClientConfig.URL != nil {
				u, err := url.Parse(*wh.ClientConfig.URL)
				if err != nil {
					return nil, fmt.Errorf("parsing webhook URL: %w", err)
				}
				if isMCPAddr(u) {
					return parseMCPAddr(u)
				}
				port := u.Port()
				if port == "" {

}

// WebhookClientConfig contains the information to make a TLS
// connection with the webhook
message WebhookClientConfig {
  // `url` gives the location of the webhook, in standard URL form
  // (`scheme://host:port/path`). Exactly one of `url` or `service`
  // must be specified.
  //
  // The `host` should not refer to a service running in the cluster; use

			Name:            slp.scope,
			StackTraceLevel: slp.logLevel,
		}
		scopeInfos = append(scopeInfos, si)
	}
	return scopeInfos, nil
}

type ControlzClient struct {
	baseURL    *url.URL
	httpClient *http.Client
}

func (c *ControlzClient) GetScopes() ([]*ScopeInfo, error) {
	var scopeInfos []*ScopeInfo
	resp, err := c.httpClient.Get(c.baseURL.String())
	if err != nil {
		return nil, err

}

// WebhookClientConfig contains the information to make a TLS
// connection with the webhook
message WebhookClientConfig {
  // `url` gives the location of the webhook, in standard URL form
  // (`scheme://host:port/path`). Exactly one of `url` or `service`
  // must be specified.
  //
  // The `host` should not refer to a service running in the cluster; use

  // as defined by RFC 3986. Paths must begin with a '/' and must be present
  // when using PathType with value "Exact" or "Prefix".
  // +optional
  optional string path = 1;

  // pathType determines the interpretation of the path matching. PathType can
  // be one of the following values:
  // * Exact: Matches the URL path exactly.

  {{- end }}
  {{- if .Values.global.logAsJson }}
    - --log_as_json
  {{- end }}
    lifecycle:
      postStart:
        exec:
          command:
          - pilot-agent
          - wait
          - --url=http://localhost:15020/healthz/ready
    env:
    - name: ISTIO_META_GENERATOR
      value: grpc
    - name: OUTPUT_CERTS
      value: /var/lib/istio/data
    {{- if eq .InboundTrafficPolicyMode "localhost" }}

  // as defined by RFC 3986. Paths must begin with a '/' and must be present
  // when using PathType with value "Exact" or "Prefix".
  // +optional
  optional string path = 1;

  // pathType determines the interpretation of the path matching. PathType can
  // be one of the following values:
  // * Exact: Matches the URL path exactly.

  optional SubjectAccessReviewStatus status = 3;
}

// NonResourceAttributes includes the authorization attributes available for non-resource requests to the Authorizer interface
message NonResourceAttributes {
  // Path is the URL path of the request
  // +optional
  optional string path = 1;

  // Verb is the standard HTTP verb
  // +optional
  optional string verb = 2;
}