XdsViaAgents bool

	// XdsViaAgentsLimit is the maximum number of pods being visited by istioctl,
	// when `XdsViaAgents` is true. This is only used in `proxy-status` command.
	// 0 means that there is no limit.
	XdsViaAgentsLimit int
}

var DefaultOptions = Options{
	MessageWriter:     os.Stdout,
	XdsViaAgents:      false,
	XdsViaAgentsLimit: 0,
}

			case err == nil:
				log.Warn("ztunnel protocol error, unexpected message")
				return fmt.Errorf("ztunnel protocol error, unexpected message")
			default:
				// we get here if error is deadline exceeded, which means ztunnel is alive.
			}

		case <-ctx.Done():
			return nil
		}
	}
}

func (z *ztunnelServer) PodDeleted(ctx context.Context, uid string) error {
	r := &zdsapi.WorkloadRequest{

	fixture.ipsetDeps.On("addIP",
		"foo-v4",
		netip.MustParseAddr("2.2.2.2"),
		ipProto,
		podUID,
		true,
	).Return(nil)

	// List should return one IP not in our "pod snapshot", which means we prune
	fixture.ipsetDeps.On("listEntriesByIP",
		"foo-v4",
	).Return([]netip.Addr{
		netip.MustParseAddr("2.2.2.2"),
		netip.MustParseAddr("6.6.6.6"),
		netip.MustParseAddr("3.3.3.3"),
	}, nil)

	dashboardCmd.PersistentFlags().BoolVar(&browser, "browser", true,
		"When --browser is supplied as false, istioctl dashboard will not open the browser. "+
			"Default is true which means istioctl dashboard will always open a browser to view the dashboard.")

	kiali := kialiDashCmd(cliContext)
	kiali.PersistentFlags().IntVar(&kialiPort, "ui-port", defaultKialiPort, "The component dashboard UI port.")

		iptableslog.UndefinedCommand, ChainInpodPrerouting, iptablesconstants.MANGLE,
		"!", "-d", iptablesconstants.IPVersionSpecific, // ignore traffic to localhost ip, as this rule means to catch traffic to pod ip.
		"-p", iptablesconstants.TCP,
		"-i", "lo",
		"-j", "ACCEPT")

//
// Doing a go test install_cni.go by itself will not execute the test as the
// file doesn't have a _test.go suffix, and this func doesn't start with a Test
// prefix. This func is only meant to be invoked programmatically. A separate
// install_cni_test.go file exists for executing this test.
func RunInstallCNITest(t *testing.T, chainedCNIPlugin bool, preConfFile, resultFileName, delayedConfFile, expectedOutputFile,

// or if a kubeconfig exists there, but differs from the current config.
// In any case, an error indicates the file must be (re)written, and no error means no action need be taken
func checkExistingKubeConfigFile(cfg *config.InstallConfig, expectedKC kubeconfig) error {
	kubeconfigFilepath := filepath.Join(cfg.MountedCNINetDir, cfg.KubeconfigFilename)

error rate, and request latency at p50, p90, and p99 percentiles. The
query results are printed to the console, organized by workload name.

All metrics returned are from server-side reports. This means that latencies
and error rates are from the perspective of the service itself and not of an
individual client (or aggregate set of clients). Rates and latencies are
calculated over a time interval of 1 minute.
`,

				case err = <-w.errorChan:
					t.Stop()
					return fmt.Errorf("unable to retrieve Kubernetes resource2 %s: %v", "", err)
				case <-ctx.Done():
					printVerbosef(cmd, "timeout")
					// I think this means the timeout has happened:
					t.Stop()
					errTmpl := "timeout expired before resource %s became effective on %s"
					var errMsg string
					if proxyFlag != "" {

	installedBins, err := in.installAll(ctx)
	if err != nil {
		return err
	}
	installLog.Info("Installation succeed, start watching for re-installation.")

	for {
		// if sleepWatchInstall yields without error, that means the config might have been modified in some fashion.
		// so we rerun `install`, which will update the modified config if it has fallen out of sync with
		// our desired state
		err := in.sleepWatchInstall(ctx, installedBins)