for _, rm := range ip.GetRangeMatchers() {
				for _, r := range rm.Ranges {
					cidr := r.AddressPrefix
					pl := r.PrefixLen.GetValue()
					if pl != 32 && pl != 128 {
						cidr += fmt.Sprintf("/%d", pl)
					}
					m[cidr] = rm.OnMatch
				}
			}
		default:
			panic("unhandled")
		}
	}
	outputs := []string{}
	for k, v := range m {

	if valErr != nil {
		return nil, fmt.Errorf("annotation value error for value %s; annotationFound = %t: %v",
			"includeIPCidrs", isFound, valErr)
	}
	isFound, redir.excludeIPCidrs, valErr = getAnnotationOrDefault("excludeIPCidrs", pi.Annotations)
	if valErr != nil {
		return nil, fmt.Errorf("annotation value error for value %s; annotationFound = %t: %v",
			"excludeIPCidrs", isFound, valErr)
	}

		schema.GroupVersionKind{Group: "", Version: "v1", Kind: "Endpoints"})
	// CRDs are not in the prune list, but must be considered for tests.
	allClusterGVKs = helmreconciler.ClusterResources
)

func init() {
	if kubeBuilderInstalled() {
		// TestMode is required to not wait in the go client for resources that will never be created in the test server.
		helmreconciler.TestMode = true

		t.Fatalf("Output didn't match for 'istioctl %s'\n got %v\nwant: %v", c.args, output, c.expectedString)
	}

	if c.notExpected != "" && strings.Contains(output, c.notExpected) {
		t.Fatalf("Output didn't match for 'istioctl %s'\n got %v\nDON'T want: %v", c.args, output, c.expectedString)
	}

	if c.shouldFail {
		if fErr == nil {
			t.Fatalf("Command should have failed for 'istioctl %s', didn't get one, output was %q",

			if err != nil {
				t.Fatal(err)
			}
			// installPackagePath may change, we will remove it for consistent output
			got = installPackagePathRegex.ReplaceAllString(got, "")

			if refreshGoldenFiles() {
				t.Logf("Refreshing golden file for %s", outPath)
				if err := os.WriteFile(outPath, []byte(got), 0o644); err != nil {
					t.Error(err)
				}
			}

			want, err := readFile(outPath)

				return nil
			}
			labels := make([]string, 0)
			for _, me := range selector.MatchExpressions {
				if me.Operator != metav1.LabelSelectorOpIn {
					continue
				}
				for _, v := range me.Values {
					labels = append(labels, fmt.Sprintf("%s=%s", me.Key, v))
				}
			}
			return labels
		}

		var isDeactivated bool
		for _, wh := range whs {

		return nil, fmt.Errorf("can't find netns for pod, this is ok if this is a newly created pod (%w)", ErrPodNotFound)
	}

	return openNetns, nil
}

// AddPodToMesh adds a pod to mesh by
// 1. Getting the netns
// 2. Adding the pod's IPs to the hostnetns ipsets for node probe checks
// 3. Creating iptables rules inside the pod's netns
// 4. Notifying ztunnel via GRPC to create a proxy for the pod
//

		return fmt.Errorf("config writer has not been primed")
	}

	w := new(tabwriter.Writer).Init(c.Stdout, 0, 8, 5, ' ', 0)

	clusterEndpoint := make([]EndpointCluster, 0)
	for _, cluster := range c.clusters.ClusterStatuses {
		for _, host := range cluster.HostStatuses {
			if filter.Verify(host, cluster.Name) {
				addr := retrieveEndpointAddress(host)
				port := retrieveEndpointPort(host)

	// XDSSAN is the expected Subject Alternative Name of the XDS server
	XDSSAN string

	// Plaintext forces plain text communication (for talking to port 15010)
	Plaintext bool

	// GCP project number or ID to use for XDS calls, if any.
	GCPProject string

	// Istiod address. For MCP may be different than Xds.
	IstiodAddr string
}

// AttachControlPlaneFlags attaches control-plane flags to a Cobra command.

// See the License for the specific language governing permissions and
// limitations under the License.

package formatting

import (
	"encoding/json"
	"fmt"
	"io"
	"os"
	"strings"

	"github.com/mattn/go-isatty"
	"sigs.k8s.io/yaml"

	"istio.io/istio/pkg/config/analysis/diag"
	"istio.io/istio/pkg/env"
)

// Formatting options for Messages
const (
	LogFormat  = "log"