return false, ""
	}
	matched = selector.Matches(labels.Set(objLabels))
	if !matched {
		return matched, ""
	}
	for _, me := range ls.MatchExpressions {
		switch me.Operator {
		case metav1.LabelSelectorOpIn, metav1.LabelSelectorOpNotIn:
			if v, exist := objLabels[me.Key]; exist {
				return matched, fmt.Sprintf("%s=%s", me.Key, v)
			}
		}
	}
	return matched, ""
}

}

type scopeStackTraceLevelPair ScopeLevelPair

func newScopeLevelPair(slp, validationPattern string) (*ScopeLevelPair, error) {
	matched, err := regexp.MatchString(validationPattern, slp)
	if err != nil {
		return nil, err
	}
	if !matched {
		return nil, fmt.Errorf("pattern %s did not match", slp)
	}
	scopeLogLevel := strings.Split(slp, ":")
	s := &ScopeLevelPair{
		scope:    scopeLogLevel[0],

	return ms
}

func recurse(name string, match *matcher.Matcher) ([]string, bool) {
	switch v := match.GetOnNoMatch().GetOnMatch().(type) {
	case *matcher.Matcher_OnMatch_Action:
		if v.Action.GetName() == name {
			// TODO this only makes sense in context of a chain... do we need a way to give it context
			return []string{"ANY"}, true
		}
	case *matcher.Matcher_OnMatch_Matcher:
		ms, f := recurse(name, v.Matcher)
		if !f {

type WorkloadFilter struct {
	Address   string
	Node      string
	Verbose   bool
	Namespace string
}

// Verify returns true if the passed workload matches the filter fields
func (wf *WorkloadFilter) Verify(workload *ZtunnelWorkload) bool {
	if wf.Address == "" && wf.Node == "" && wf.Namespace == "" {
		return true
	}

	if wf.Namespace != "" {

	return l.HealthStatus.GetEdsHealthStatus()
}

func retrieveFailedOutlierCheck(l *admin.HostStatus) bool {
	return l.HealthStatus.GetFailedOutlierCheck()
}

// Verify returns true if the passed host matches the filter fields
func (e *EndpointFilter) Verify(host *admin.HostStatus, cluster string) bool {
	if e.Address == "" && e.Port == 0 && e.Cluster == "" && e.Status == "" {
		return true
	}

// https://www.tldp.org/LDP/abs/html/exitcodes.html#EXITCODESREF) and then some
// used by convention (see sysexits).
//
// The intention here is to use 64-78 in a way that matches the attempt in
// sysexits to signify some error running istioctl, and use 79-125 as custom
// error codes for other info that we'd like to use to pass info on.
const (

)

// PolicyFilter is used to pass filter information into service based config writer print functions
type PolicyFilter struct {
	Namespace string
}

// Verify returns true if the passed workload matches the filter fields
func (wf *PolicyFilter) Verify(pol *ZtunnelPolicy) bool {
	if wf.Namespace != "" {
		if !strings.EqualFold(pol.Namespace, wf.Namespace) {
			return false
		}
	}

	return true
}

			l.LogAndFatal(err)
		}
	}

	if err := operatorutil.CreateNamespace(kubeClient.Kube(), oiArgs.common.operatorNamespace, "", opts.DryRun); err != nil {
		l.LogAndFatal(err)
	}

	// create watched namespaces
	namespaces := strings.Split(oiArgs.common.watchedNamespaces, ",")
	// if the namespace in the CR is provided, consider creating it too.
	if istioNamespace != "" {
		namespaces = append(namespaces, istioNamespace)

		if len(filename) == 0 {
			filename = "YYY-istio-cni.conf"
		}
		return filepath.Join(cfg.mountedCNINetDir, filename), nil
	}

	watcher, err := util.CreateFileWatcher(cfg.mountedCNINetDir)
	if err != nil {
		return "", err
	}
	defer watcher.Close()

	for len(filename) == 0 {
		filename, err = getDefaultCNINetwork(cfg.mountedCNINetDir)
		if err == nil {
			break
		}

		return "everything"
	}

	matches := []string{}
	for _, trafficMatch := range trafficMatches {
		matches = append(matches, renderMatch(trafficMatch))
	}
	return strings.Join(matches, ", ")
}

func renderMatch(match *v1alpha3.HTTPMatchRequest) string {
	retval := "Match: "
	// TODO Are users interested in seeing Scheme, Method, Authority?
	if match.Uri != nil {
		retval += renderStringMatch(match.Uri)