Ben Leggett <******@****.***> 1706301268 -0500

John Howard <******@****.***> 1713461801 -0700

Ben Leggett <******@****.***> 1707525115 -0500

				} else {
					path := "config_dump"
					envoyDump, err = kubeClient.EnvoyDo(context.TODO(), podName, ns, "GET", path)
				}
				if err != nil {
					return fmt.Errorf("could not contact sidecar: %w", err)
				}

				xdsRequest := discovery.DiscoveryRequest{
					ResourceNames: []string{fmt.Sprintf("%s.%s", podName, ns)},
					TypeUrl:       pilotxds.TypeDebugConfigDump,
				}

				if err != nil {
					return err
				}
			}

			return portForward(podName, ns, fmt.Sprintf("Envoy sidecar %s", podName),
				"http://%s", bindAddress, proxyAdminPort, kubeClient, c.OutOrStdout(), browser)
		},
	}

	return cmd
}

// port-forward to sidecar Envoy admin port; open browser
func envoyDashCmd(ctx cli.Context) *cobra.Command {
	return createDashCmd(ctx, CreateProxyDashCmdConfig{

	ns.ObjectMeta.Labels = map[string]string{constants.DataplaneModeLabel: constants.DataplaneModeAmbient}

	testDoAddRun(t, cniConf, testNSName, pod, ns)

	wasCalled := serverClose()
	// Pod has sidecar annotation from injector, should not be added to mesh
	assert.Equal(t, wasCalled, false)
}

func TestCmdAddPodWithGenericSidecar(t *testing.T) {
	url, serverClose := setupCNIEventClientWithMockServer(false)

	// This is effectively an analog for Istio's old-style podSpec-based health check rewrites.
	// Before Istio would update the pod manifest to rewrite healthchecks to go to sidecar Envoy port 15021,
	// so that it could distinguish things that can be unauthenticated (healthchecks) from other kinds of node traffic
	// (e.g. LoadBalanced Service packets, etc) that need to be authenticated/captured/proxied.
	//

		Annotations: map[string]string{
			"sidecar.istio.io/status": "something",
		},
		Labels: map[string]string{
			"testlabel": "true",
		},
		NodeName:            "test-node",
		InitContainerStatus: &brokenInitContainerTerminating,
	})

	brokenPodWaiting = makePod(makePodArgs{
		PodName: "broken-pod-waiting",
		Annotations: map[string]string{
			"sidecar.istio.io/status": "something",
		},

	whcName             string
	iopFilename         string
)

const (
	defaultMeshConfigMapName       = "istio"
	defaultInjectConfigMapName     = "istio-sidecar-injector"
	defaultInjectWebhookConfigName = "istio-sidecar-injector"
	defaultWebhookName             = "sidecar-injector.istio.io"
)

func InjectCommand(cliContext cli.Context) *cobra.Command {
	var opts clioptions.ControlPlaneOptions

		{
			name: "ambient mode enabled for neither namespace nor pod",
			args: args{
				namespace: unlabelledNamespace,
				pod:       unlabelledPod,
			},
			want: false,
		},
		{
			name: "pod has sidecar and namespace has ambient enabled",
			args: args{
				namespace: namespaceWithAmbientEnabledLabel,
				pod:       podWithSidecar,
			},
			want: false,
		},
		{