}
	c.clusters = &cd
	return nil
}

func retrieveEndpointAddress(host *admin.HostStatus) string {
	addr := host.Address.GetSocketAddress()
	if addr != nil {
		return addr.Address
	}
	if pipe := host.Address.GetPipe(); pipe != nil {
		return "unix://" + pipe.Path
	}
	if internal := host.Address.GetEnvoyInternalAddress(); internal != nil {

	wg := &WaitGroup{
		done: make(chan struct{}),
	}

	wg.Add(n)
	return wg, func() {
		select {
		case <-wg.C():
			return
		case <-time.After(time.Second):
			t.Fatal("Wait group timed out!\n")
		}
	}
}

func (wg *WaitGroup) Add(i int32) {
	select {
	case <-wg.done:
		panic("use of an already closed WaitGroup")
	default:
	}

func addPodToHostNSIpset(pod *corev1.Pod, podIPs []netip.Addr, hostsideProbeSet *ipset.IPSet) error {
	// Add the pod UID as an ipset entry comment, so we can (more) easily find and delete
	// all relevant entries for a pod later.
	podUID := string(pod.ObjectMeta.UID)
	ipProto := uint8(unix.IPPROTO_TCP)

	var ipsetAddrErrs []error

	// For each pod IP
	for _, pip := range podIPs {
		// Add to host ipset

func retrieveListenerAdditionalAddresses(l *listener.Listener) []string {
	var addrs []string
	socketAddresses := l.GetAdditionalAddresses()
	for _, socketAddr := range socketAddresses {
		addr := socketAddr.Address
		addrs = append(addrs, addr.GetSocketAddress().Address)
	}

	return addrs
}

func retrieveListenerPort(l *listener.Listener) uint32 {
	return l.Address.GetSocketAddress().GetPortValue()
}

		if _, ok := err.(ControlPlaneNotFoundError); ok {
			// Attempt to get the XDS address from the webhook and try again
			addr, err := getXdsAddressFromWebhooks(kubeClient)
			if err == nil {
				centralOpts.Xds = addr.host
				centralOpts.GCPProject = addr.gcpProject
				centralOpts.IstiodAddr = addr.istiod
				dialOpts, err := xds.DialOptions(centralOpts, istioNamespace, tokenServiceAccount, kubeClient)
				if err != nil {

{{- if regexMatch "^([0-9]*\\.){3}[0-9]*$" .Values.global.remotePilotAddress }}
# if the remotePilotAddress is an IP addr
apiVersion: v1
kind: Endpoints
metadata:
  {{- if .Values.pilot.enabled }}
  name: istiod{{- if .Values.revision }}-{{ .Values.revision}}{{- end }}-remote
  {{- else }}
  name: istiod{{- if .Values.revision }}-{{ .Values.revision}}{{- end }}
  {{- end }}
  namespace: {{ .Release.Namespace }}
subsets:
- addresses:

	return s.netServer.ConstructInitialSnapshot(ambientPods)
}

func (s *meshDataplane) AddPodToMesh(ctx context.Context, pod *corev1.Pod, podIPs []netip.Addr, netNs string) error {
	var retErr error
	err := s.netServer.AddPodToMesh(ctx, pod, podIPs, netNs)
	if err != nil {
		log.Errorf("failed to add pod to ztunnel: %v", err)
		if !errors.Is(err, ErrPartialAdd) {
			return err
		}
		retErr = err
	}

} {
	// go uses @ instead of \0 for abstract unix sockets
	addr := fmt.Sprintf("@testaddr%d", ztunnelTestCounter.Add(1))
	ztun, err := newZtunnelServer(addr, pods)
	if err != nil {
		panic(err)
	}
	go ztun.Run(ctx)

	// now as a client connect confirm we and get snapshot
	resolvedAddr, err := net.ResolveUnixAddr("unixpacket", addr)
	if err != nil {
		panic(err)
	}

}

func (m *realDeps) listEntriesByIP(name string) ([]netip.Addr, error) {
	var ipList []netip.Addr

	res, err := netlink.IpsetList(name)
	if err != nil {
		return ipList, fmt.Errorf("failed to list ipset %s: %w", name, err)
	}

	for _, entry := range res.Entries {
		addr, _ := netip.AddrFromSlice(entry.IP)
		ipList = append(ipList, addr)
	}

	return ipList, nil

      runAsUser: {{ .ProxyUID | default "1337" }}
      runAsGroup: {{ .ProxyGID | default "1337" }}
    env:
    - name: PILOT_CERT_PROVIDER
      value: {{ .Values.global.pilotCertProvider }}
    - name: CA_ADDR
    {{- if .Values.global.caAddress }}
      value: {{ .Values.global.caAddress }}
    {{- else }}