return
		case <-time.After(time.Second):
			t.Fatal("Wait group timed out!\n")
		}
	}
}

func (wg *WaitGroup) Add(i int32) {
	select {
	case <-wg.done:
		panic("use of an already closed WaitGroup")
	default:
	}
	atomic.AddInt32(&wg.count, i)
}

func (wg *WaitGroup) Done() {
	i := atomic.AddInt32(&wg.count, -1)
	if i == 0 {
		close(wg.done)
	}
}

	assert.NoError(t, w.Close())
	out, err := io.ReadAll(r)
	assert.NoError(t, err)

	// For each level, there should be two lines, one from direct log,
	// the other one from UDS server
	wantLevels := []string{"debug", "info", "warn", "error", "debug", "info", "warn", "error"}
	gotLogs := strings.Split(
		strings.TrimSuffix(string(out), "\n"), "\n")
	if want, got := len(wantLevels), len(gotLogs); want != got {

			error:         "",
		},
	}

	for _, tc := range tcs {
		t.Run(tc.name, func(t *testing.T) {
			var out bytes.Buffer
			client := fake.NewSimpleClientset(tc.webhooks.DeepCopyObject(), tc.namespaces.DeepCopyObject())
			outputFormat = util.JSONFormat
			err := listTags(context.Background(), client, &out)
			if tc.error == "" && err != nil {
				t.Fatalf("expected no error, got %v", err)
			}
			if tc.error != "" {

			return r
		}
		return cmp.Compare(a.Name, b.Name)
	})
	out, err := json.MarshalIndent(policies, "", "    ")
	if err != nil {
		return fmt.Errorf("failed to marshal policies: %v", err)
	}
	if outputFormat == "yaml" {
		if out, err = yaml.JSONToYAML(out); err != nil {
			return err
		}
	}
	fmt.Fprintln(c.Stdout, string(out))
	return nil

		},
	}
	opts.AttachControlPlaneFlags(cmd)
	return cmd
}

func writeMulticlusterStatus(out io.Writer, input map[string][]byte) error {
	statuses, err := parseClusterStatuses(input)
	if err != nil {
		return err
	}
	w := new(tabwriter.Writer).Init(out, 0, 8, 5, ' ', 0)
	_, _ = fmt.Fprintln(w, "NAME\tSECRET\tSTATUS\tISTIOD")
	for istiod, clusters := range statuses {

	tempDir := t.TempDir()

	cfg := &config.InstallConfig{
		MountedCNINetDir: tempDir,
		KubeCAFile:       kubeCAFilepath,
		K8sServiceHost:   k8sServiceHost,
		K8sServicePort:   k8sServicePort,
	}
	// Write out a kubeconfig with one cert
	result, err := createKubeConfig(cfg)
	if err != nil {
		t.Fatalf("did not expect failure: %v", err)
	}
	goldenFilepath := "testdata/kubeconfig-tls"

	gotOut := &bytes.Buffer{}
	cw := &ConfigWriter{Stdout: gotOut}
	cd, _ := os.ReadFile("testdata/ecds/configdump.json")
	cw.Prime(cd)
	err := cw.PrintEcds("json")
	assert.NoError(t, err)

	// protojson opt out of whitespace randomization, see more details: https://github.com/golang/protobuf/issues/1082
	var rm json.RawMessage = gotOut.Bytes()
	jsonOutput, err := json.MarshalIndent(rm, "", "    ")
	if err != nil {
		assert.NoError(t, err)

	// as we are running within a privileged container - and we don't want to take the time to
	// redetect for each pod anyway.
	//
	// Extreme corner case:
	// If for some reason your host had both binaries, and you were injecting out-of-band
	// iptables rules within a pod context into `legacy` tables, but your host context preferred
	// `nft`, we would still inject our rules in-pod into nft tables, which is a bit wonky.
	//

	pod.Spec.Containers = []corev1.Container{app}

	testDoAddRun(t, cniConf, testNSName, pod, ns)

	wasCalled := serverClose()
	// Pod has an explicit opt-out label, should not be added to ambient mesh
	assert.Equal(t, wasCalled, false)
}

func TestCmdAddPodEnabledNamespaceDisabled(t *testing.T) {
	url, serverClose := setupCNIEventClientWithMockServer(false)

			return false
		}
		return true
	})
	out, err := json.MarshalIndent(workloads, "", "    ")
	if err != nil {
		return fmt.Errorf("failed to marshal workloads: %v", err)
	}
	if outputFormat == "yaml" {
		if out, err = yaml.JSONToYAML(out); err != nil {
			return err
		}
	}
	fmt.Fprintln(c.Stdout, string(out))
	return nil
}