goldenFileSuffixHideChangesInReview = ".golden.yaml"
	goldenFileSuffixShowChangesInReview = ".golden-show-in-gh-pull-request.yaml"
)

var (
	// By default, tests only run with manifest generate, since it doesn't require any external fake test environment.
	testedManifestCmds = []cmdType{cmdGenerate}
	// Only used if kubebuilder is installed.
	testenv    *envtest.Environment
	testClient client.Client

`,
		Example: `  # Retrieve sync status for all Envoys in a mesh
  istioctl x internal-debug syncz

  # Retrieve sync diff for a single Envoy and Istiod
  istioctl x internal-debug syncz istio-egressgateway-59585c5b9c-ndc59.istio-system

  # SECURITY OPTIONS

  # Retrieve syncz debug information directly from the control plane, using token security

		chains := getFilterChains(l)
		lname := "envoy://" + l.GetName()
		// Avoid duplicating the listener and filter name
		if l.GetInternalListener() != nil && len(chains) == 1 && chains[0].GetName() == lname {
			lname = "internal"
		}
		for _, fc := range chains {

			name := fc.GetName()
			matches := newMatcher(fc, l)
			destination := getFilterType(fc.GetFilters())
			for _, match := range matches {

			return nil, err
		}
	}
	if minor <= 20 {
		// VERIFY_CERTIFICATE_AT_CLIENT and ENABLE_AUTO_SNI
		if err := checkDestinationRuleTLS(cli, &messages); err != nil {
			return nil, err
		}
		// ENABLE_EXTERNAL_NAME_ALIAS
		if err := checkExternalNameAlias(cli, &messages); err != nil {
			return nil, err
		}
		// PERSIST_OLDEST_FIRST_HEURISTIC_FOR_VIRTUAL_SERVICE_HOST_MATCHING

	configureCmd.PersistentFlags().StringVar(&internalIP, "internalIP", "", "Internal IP address of the workload")
	configureCmd.PersistentFlags().StringVar(&externalIP, "externalIP", "", "External IP address of the workload")
	opts.AttachControlPlaneFlags(configureCmd)
	return configureCmd
}

	}
	if addr := addr.GetPipe(); addr != nil {
		return addr.GetPath()
	}
	if internal := addr.GetEnvoyInternalAddress(); internal != nil {
		switch an := internal.GetAddressNameSpecifier().(type) {
		case *core.EnvoyInternalAddress_ServerListenerName:
			return fmt.Sprintf("envoy://%s/%s", an.ServerListenerName, internal.EndpointId)
		}
	}
	return "unknown"
}

	RepairInitExitCode       = "repair-init-container-exit-code"
	RepairLabelSelectors     = "repair-label-selectors"
	RepairFieldSelectors     = "repair-field-selectors"
)

// Internal constants
const (
	DefaultKubeconfigMode = 0o600

	CNIAddEventPath = "/cmdadd"
	UDSLogPath      = "/log"

	// K8s liveness and readiness endpoints
	LivenessEndpoint  = "/healthz"

Xiaopeng Han <******@****.***> 1710491330 +0800

		g.Expect(c).Should(HavePathValueEqual(PathValue{"env.[name:PILOT_CERT_PROVIDER].value", "foobar"}))
		g.Expect(s).Should(HavePathValueContain(PathValue{"metadata.annotations", toMap("cloud.google.com/load-balancer-type: internal")}))
		g.Expect(s).Should(HavePathValueContain(PathValue{"spec.ports.[0]", portVal("grpc-pilot-mtls", 15011, -1)}))
		g.Expect(s).Should(HavePathValueContain(PathValue{"spec.ports.[1]", portVal("tcp-citadel-grpc-tls", 8060, 8060)}))