if !gateway.IsManaged(&t.Spec) {
			return "", nil, fmt.Errorf("gateway is not a managed gateway")
		}
		namespace = t.Namespace
		selector, err = labels.Parse(constants.GatewayNameLabel + "=" + t.Name)
	case *gatewayapibeta.Gateway:
		if !gateway.IsManaged(&t.Spec) {
			return "", nil, fmt.Errorf("gateway is not a managed gateway")
		}
		namespace = t.Namespace

				makeGateway(constants.DefaultNamespaceWaypoint, "default", true, true),
				makeGateway(constants.DefaultNamespaceWaypoint, "fake", true, true),
			},
			expectedOutFile: "all-gateway",
		},
		{
			name: "have both managed and unmanaged gateways",
			args: strings.Split("list -A", " "),
			gateways: []*gateway.Gateway{
				makeGateway("bookinfo", "default", false, true),
				makeGateway("bookinfo-invalid", "fake", true, false),

	}
	// Use bearer token
	aud := tokenAudiences
	isMCP := strings.HasSuffix(opts.Xds, ".googleapis.com") || strings.HasSuffix(opts.Xds, ".googleapis.com:443")
	if isMCP {
		// Special credentials handling when using ASM Managed Control Plane.
		mem, err := getHubMembership(ctx, kubeClient)
		if err != nil {
			return nil, fmt.Errorf("failed to query Hub membership: %w", err)
		}
		aud = []string{mem.WorkloadIdentityPool}
	}

	rbachttp "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/http/rbac/v3"
	hcm "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/network/http_connection_manager/v3"
	"github.com/hashicorp/go-multierror"
	"github.com/spf13/cobra"
	"google.golang.org/protobuf/types/known/structpb"
	corev1 "k8s.io/api/core/v1"
	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"

	outputFormat := "short"

	logCmd := &cobra.Command{
		Use:   "log [<pod-name>]|[-r|--revision] [--level <scope>:<level>][--stack-trace-level <scope>:<level>]|[--reset]|[--output|-o short|json|yaml]",
		Short: "Manage istiod logging.",
		Long:  "Retrieve or update logging levels of istiod components.",
		Example: `  # Retrieve information about istiod logging levels.
  istioctl admin log

		},
	}
	waypointDeleteCmd.Flags().BoolVar(&deleteAll, "all", false, "Delete all waypoints in the namespace")

	waypointListCmd := &cobra.Command{
		Use:   "list",
		Short: "List managed waypoint configurations",
		Long:  "List managed waypoint configurations in the cluster",
		Example: `  # List all waypoints in a specific namespace
  istioctl x waypoint list --namespace default

  # List all waypoints in the cluster

	// init container termination message and exit code.
	SidecarAnnotation  string
	InitContainerName  string
	InitTerminationMsg string
	InitExitCode       int

	// Label and field selectors to select pods managed by race repair.
	LabelSelectors string
	FieldSelectors string
}

func (c InstallConfig) String() string {
	var b strings.Builder
	b.WriteString("CNINetDir: " + c.CNINetDir + "\n")

						Namespace: "default",
						Name:      "istiod",
					},
					CABundle: []byte("ca"),
				},
			},
		},
	}
	samplePath               = "/sample/path"
	operatorManaged          = operatorNamespace + "/managed"
	revisionCanonicalWebhook = admitv1.MutatingWebhookConfiguration{
		ObjectMeta: metav1.ObjectMeta{
			Name: "istio-sidecar-injector-revision",
			Labels: map[string]string{
				label.IoIstioRev.Name: "revision",

		"The value portion of the label which will be set by the race repair if label pods is true")
	registerStringParameter(constants.RepairNodeName, "", "The name of the managed node (will manage all nodes if unset)")
	registerStringParameter(constants.RepairSidecarAnnotation, "sidecar.istio.io/status",

	AutoInjectNamespaces bool
	// CustomLabels are labels to add to the generated webhook.
	CustomLabels map[string]string
	// UserManaged indicates whether the revision tag is user managed.
	// If true, the revision tag will not be affected by the installer.
	UserManaged bool
}

// Generate generates the manifests for a revision tag pointed the given revision.