for _, response := range xdsResponses {
		for _, resource := range response.Resources {
			eString := string(resource.Value)
			switch {
			case strings.Contains(eString, "You must provide a proxyID in the query string"):
				return nil, fmt.Errorf(" You must provide a proxyID in the query string, e.g. [%s]",
					"edsz?proxyID=istio-ingressgateway")

			case strings.Contains(eString, "404 page not found"):

)

type profileDiffTestcase struct {
	args           string
	shouldFail     bool
	expectedString string // String output is expected to contain
	notExpected    string // String the output must NOT contain
}

func TestProfileDiff(t *testing.T) {
	cases := []profileDiffTestcase{
		{
			args:       "profile diff demo default --unknown-flag",
			shouldFail: true,
		},
		{

	for _, p := range procs {
		ns := getPidNamespace(p.PID)
		fd, err := unix.Open(ns, unix.O_RDONLY, 0)
		if err != nil {
			// Not uncommon, many processes are transient and we have a TOCTOU here.
			// No problem, must not be the one we are after.
			log.Debugf("failed to open pid %v: %v", p.PID, err)
			continue
		}
		id, err := netlink.GetNetNsIdByFd(fd)
		_ = unix.Close(fd)
		if err != nil {

  istioctl proxy-status

  # Retrieve proxy status information directly from the control plane, using RSA certificate security
  # (Certificates must be obtained before this step.  The --cert-dir flag lets istioctl bypass the Kubernetes API server.)
  istioctl ps --xds-address istio.example.com:15012 --cert-dir ~/.istio-certs

	testClient client.Client

	allNamespacedGVKs = append(helmreconciler.NamespacedResources(),
		schema.GroupVersionKind{Group: "", Version: "v1", Kind: "Endpoints"})
	// CRDs are not in the prune list, but must be considered for tests.
	allClusterGVKs = helmreconciler.ClusterResources
)

func init() {
	if kubeBuilderInstalled() {

		return err
	}

	log.Debug("notifying subscribed node proxies")
	if err := s.sendPodToZtunnelAndWaitForAck(ctx, pod, openNetns); err != nil {
		// we must return PartialAdd error here. the pod was injected with iptables rules,
		// so it should be annotated, so if it is removed from the mesh, the rules will be removed.

			if token == "" {
				break
			}
		}
	} else {
		// If there is a specific pod name in ResourceName, use the agent in the pod.
		if len(dr.ResourceNames) != 1 {
			return nil, fmt.Errorf("`ResourceNames` must have one element when `all` flag is turned on")
		}
		slice := strings.SplitN(dr.ResourceNames[0], ".", 2)
		if len(slice) != 2 {
			return nil, fmt.Errorf("invalid resource name format: %v", slice)
		}

	installerScope.Debugf("Using the following manifest to install operator:\n%s\n", mstr)

	opts := &applyOptions{
		DryRun: args.DryRun,
	}

	// If CR was passed, we must create a namespace for it and install CR into it.
	customResource, istioNamespace, err := getCRAndNamespaceFromFile(oiArgs.inFilename, l)
	if err != nil {
		l.LogAndFatal(err)
	}
	var iop *iopv1alpha1.IstioOperator

// via the nodeIP
// - kubelet (node-local healthchecks, which we do not capture)
// - kube-proxy (fowarded/proxied traffic from LoadBalancer-backed services, potentially with public IPs, which we must capture)
func (cfg *IptablesConfigurator) CreateHostRulesForHealthChecks(hostSNATIP, hostSNATIPV6 *netip.Addr) error {
	// Append our rules here
	builder := cfg.appendHostRules(hostSNATIP, hostSNATIPV6)

		Args: func(cmd *cobra.Command, args []string) error {
			if orArgs.revision == "" && !orArgs.purge {
				return fmt.Errorf("at least one of the --revision or --purge flags must be set")
			}
			if len(args) > 0 {
				return fmt.Errorf("istioctl operator remove does not take arguments")
			}
			return nil
		},
		RunE: func(cmd *cobra.Command, args []string) error {