return err
			}
			var podNames []string
			var podNamespace string
			if len(args) == 1 {
				podName, ns, err := getComponentPodName(ctx, args[0])
				if err != nil {
					return err
				}
				ztunnelPod := ambientutil.IsZtunnelPod(kubeClient, podName, ns)
				if !ztunnelPod {
					return fmt.Errorf("workloads command is only supported by Ztunnel proxies: %v", podName)
				}
				podNames = []string{podName}

				// only use the first pod in the list
				podName = pl.Items[0].Name
				ns = pl.Items[0].Namespace
			} else {
				podName, ns, err = ctx.InferPodInfoFromTypedResource(args[0], ctx.IstioNamespace())
				if err != nil {
					return err
				}
			}
			port := inferMonitoringPort(client, podName, ns)
			return portForward(podName, ns, fmt.Sprintf("Istio debug %s", podName),

		return err
	}

	// Check if the workload is running under Kubernetes.
	podNamespace := string(k8sArgs.K8S_POD_NAMESPACE)
	podName := string(k8sArgs.K8S_POD_NAME)
	log := log.WithLabels("pod", podNamespace+"/"+podName)
	if podNamespace == "" || podName == "" {
		log.Debugf("Not a kubernetes pod")
		return nil
	}

	for _, excludeNs := range conf.ExcludeNamespaces {
		if podNamespace == excludeNs {

				// only use the first pod in the list
				podName = pl.Items[0].Name
				ns = pl.Items[0].Namespace
			} else if len(args) == 1 {
				podName, ns = args[0], ctx.IstioNamespace()
			}

			portForwarder, err := client.NewPortForwarder(podName, ns, "", 0, controlzPort)
			if err != nil {
				return fmt.Errorf("could not build port forwarder for ControlZ %s: %v", podName, err)
			}
			defer portForwarder.Close()

	"istio.io/istio/tools/istio-iptables/pkg/constants"
)

func TestMatchesFilter(t *testing.T) {
	makeDetectPod := func(name string, terminationMessage string, exitCode int) *corev1.Pod {
		return makePod(makePodArgs{
			PodName:     name,
			Annotations: map[string]string{"sidecar.istio.io/status": "something"},
			InitContainerStatus: &corev1.ContainerStatus{
				Name: constants.ValidationContainerName,
				State: corev1.ContainerState{

// * the pod, if it is found and ambient is enabled
func (s *InformerHandlers) GetPodIfAmbient(podName, podNamespace string) (*corev1.Pod, error) {
	ns := s.namespaces.Get(podNamespace, "")
	if ns == nil {
		return nil, fmt.Errorf("failed to find namespace %v", ns)
	}
	pod := s.pods.Get(podName, podNamespace)
	if pod == nil {
		return nil, fmt.Errorf("failed to find pod %v", ns)
	}

		testServer.Close()
		return cniAddServerCalled
	}
}

func buildCmdArgs(stdinData, podName, podNamespace string) *skel.CmdArgs {
	return &skel.CmdArgs{
		ContainerID: "testContainerID",
		Netns:       testSandboxDirectory,
		IfName:      "eth0",
		Args:        fmt.Sprintf("K8S_POD_NAMESPACE=%s;K8S_POD_NAME=%s", podNamespace, podName),
		Path:        "/tmp",
		StdinData:   []byte(stdinData),
	}
}

		}
		slice := strings.SplitN(dr.ResourceNames[0], ".", 2)
		if len(slice) != 2 {
			return nil, fmt.Errorf("invalid resource name format: %v", slice)
		}
		podName := slice[0]
		ns := slice[1]
		pod, err := kubeClient.Kube().CoreV1().Pods(ns).Get(context.TODO(), podName, metav1.GetOptions{})
		if err != nil {
			return nil, err
		}
		resp, err := queryToOnePod(pod)
		if err != nil {
			return nil, err
		}

  //
  // This field is immutable.
  //
  // +optional
  optional bool attachRequired = 1;

  // podInfoOnMount indicates this CSI volume driver requires additional pod information (like podName, podUID, etc.)
  // during mount operations, if set to true.
  // If set to false, pod information will not be passed on mount.
  // Default is false.
  //

  //
  // This field is immutable.
  //
  // +optional
  optional bool attachRequired = 1;

  // podInfoOnMount indicates this CSI volume driver requires additional pod information (like podName, podUID, etc.)
  // during mount operations, if set to true.
  // If set to false, pod information will not be passed on mount.
  // Default is false.
  //