if err := s.sendPodToZtunnelAndWaitForAck(ctx, pod, openNetns); err != nil {
		// we must return PartialAdd error here. the pod was injected with iptables rules,
		// so it should be annotated, so if it is removed from the mesh, the rules will be removed.
		// alternatively, we may not return an error at all, but we want this to fail on tests.
		return NewErrPartialAdd(err)
	}
	return nil
}

			got, err := runProfileDump(inPath, tt.configPath, snapshotCharts, "")
			if err != nil {
				t.Fatal(err)
			}
			// installPackagePath may change, we will remove it for consistent output
			got = installPackagePathRegex.ReplaceAllString(got, "")

			if refreshGoldenFiles() {
				t.Logf("Refreshing golden file for %s", outPath)

func OperatorCmd(ctx cli.Context) *cobra.Command {
	oc := &cobra.Command{
		Use:   "operator",
		Short: "Commands related to Istio operator controller.",
		Long:  "The operator command installs, dumps, removes and shows the status of the operator controller.",
	}

	odArgs := &operatorDumpArgs{}
	oiArgs := &operatorInitArgs{}
	orArgs := &operatorRemoveArgs{}
	args := &RootArgs{}

	odc := operatorDumpCmd(args, odArgs)

		pod,
	).Return(nil)

	fakeClientSet := fake.NewSimpleClientset()
	m := meshDataplane{
		kubeClient: fakeClientSet,
		netServer:  server,
	}

	// pod is not in fake client, so if this will try to remove annotation, it will fail.
	err := m.DelPodFromMesh(fakeCtx, pod)
	assert.NoError(t, err)
}

func TestMeshDataplaneDelPodErrorDoesntPatchPod(t *testing.T) {
	pod := podWithAnnotation()

			"changed paths with the value changes shown as OLD-VALUE -> NEW-VALUE.\n" +
			"List order changes are shown as [OLD-INDEX->NEW-INDEX], with ? used where a list item is added or\n" +
			"removed.",
		Args: func(cmd *cobra.Command, args []string) error {
			if len(args) != 2 {
				return fmt.Errorf("diff requires two files or directories")
			}
			return nil
		},

}

func (p *podNetnsCache) ReadCurrentPodSnapshot() map[string]WorkloadInfo {
	p.mu.RLock()
	defer p.mu.RUnlock()
	// snapshot the cache to avoid long locking
	return maps.Clone(p.currentPodCache)
}

// Remove and return the Netns for the given uid
// No need to return NetnsCloser here it will be closed automatically on GC.
// (it may be used in parallel by other parts of the code, so we want it to be used only when not used)

		},
	}
	for _, dir := range files {
		if !dir.IsDir() {
			continue
		}
		testdir := path.Join("testdata/vmconfig", dir.Name())
		t.Cleanup(func() {
			for k := range generated {
				os.Remove(path.Join(testdir, k))
			}
		})
		t.Run(dir.Name(), func(t *testing.T) {
			createClientFunc := func(client kube.CLIClient) {

	log := log.WithLabels("ns", pod.Namespace, "name", pod.Name)
	err := s.netServer.RemovePodFromMesh(ctx, pod)
	if err != nil {
		log.Errorf("failed to remove pod from mesh: %v", err)
		return err
	}
	log.Debug("removing annotation from pod")
	err = util.AnnotateUnenrollPod(s.kubeClient, &pod.ObjectMeta)
	if err != nil {

		return []string{}, err
	}
	if d, ok := decoded.(map[string]any); ok {
		if v, ok := d["spec"]; ok {
			// Fall back to showing the entire spec.
			// (When --config-path is used there will be no spec to remove)
			decoded = v
		}
	}
	setflags, err := walk("", "", decoded)
	if err != nil {
		return []string{}, err
	}
	sort.Strings(setflags)
	return setflags, nil
}

				return nil
			} else if op == "del" {
				return fmt.Errorf("FAIL: File %v was not removed from %v", f, tempCNIBinDir)
			}
		} else {
			if op == "add" {
				return fmt.Errorf("FAIL: File %v was not added to %v", f, tempCNIBinDir)
			} else if op == "del" {
				t.Logf("PASS: File %v was removed from %v", f, tempCNIBinDir)
				return nil
			}
		}
	}