verifying a presented server certificate.'
                                    type: string
                                  caCrl:
                                    description: 'OPTIONAL: The path to the file containing
                                      the certificate revocation list (CRL) to use
                                      in verifying a presented server certificate.'

)

// ServiceFilter is used to pass filter information into service based config writer print functions
type ServiceFilter struct {
	Namespace string
}

// Verify returns true if the passed workload matches the filter fields
func (wf *ServiceFilter) Verify(svc *ZtunnelService) bool {
	if wf.Namespace != "" {
		if !strings.EqualFold(svc.Namespace, wf.Namespace) {
			return false
		}
	}

	return true
}

	core "github.com/envoyproxy/go-control-plane/envoy/config/core/v3"
	listener "github.com/envoyproxy/go-control-plane/envoy/config/listener/v3"

	"istio.io/istio/pkg/wellknown"
)

func TestListenerFilter_Verify(t *testing.T) {
	tests := []struct {
		desc       string
		inFilter   *ListenerFilter
		inListener *listener.Listener
		expect     bool
	}{
		{
			desc: "filter-fields-empty",
			inFilter: &ListenerFilter{

pilot:
  env:
    # 1.21 behavioral changes
    ENABLE_EXTERNAL_NAME_ALIAS: "false"
    PERSIST_OLDEST_FIRST_HEURISTIC_FOR_VIRTUAL_SERVICE_HOST_MATCHING: "true"
    VERIFY_CERTIFICATE_AT_CLIENT: "false"
    ENABLE_AUTO_SNI: "false"

    # 1.22 behavioral changes
    ENABLE_RESOLUTION_NONE_TARGET_PORT: "false"

meshConfig:
  # 1.22 behavioral changes
  defaultConfig:

pilot:
  env:
    # 1.21 behavioral changes
    ENABLE_EXTERNAL_NAME_ALIAS: "false"
    PERSIST_OLDEST_FIRST_HEURISTIC_FOR_VIRTUAL_SERVICE_HOST_MATCHING: "true"
    VERIFY_CERTIFICATE_AT_CLIENT: "false"
    ENABLE_AUTO_SNI: "false"

    # 1.22 behavioral changes
    ENABLE_RESOLUTION_NONE_TARGET_PORT: "false"

meshConfig:
  # 1.22 behavioral changes
  defaultConfig:

pilot:
  env:
    # 1.21 behavioral changes
    ENABLE_EXTERNAL_NAME_ALIAS: "false"
    PERSIST_OLDEST_FIRST_HEURISTIC_FOR_VIRTUAL_SERVICE_HOST_MATCHING: "true"
    VERIFY_CERTIFICATE_AT_CLIENT: "false"
    ENABLE_AUTO_SNI: "false"

    # 1.22 behavioral changes
    ENABLE_RESOLUTION_NONE_TARGET_PORT: "false"

meshConfig:
  # 1.22 behavioral changes
  defaultConfig:

  // +optional
  optional string token = 1;

  // Audiences is a list of the identifiers that the resource server presented
  // with the token identifies as. Audience-aware token authenticators will
  // verify that the token was intended for at least one of the audiences in
  // this list. If no audiences are provided, the audience will default to the
  // audience of the Kubernetes apiserver.
  // +optional

		// last exited. If a pod is using the CNI configuration check init container,
		// it will start crashlooping and populate this struct.
		if state := container.LastTerminationState.Terminated; state != nil {
			// Verify the container state matches our filter criteria
			if matchTerminationMessage(state) && matchExitCode(state) {
				return true
			}
		}
	}
	return false

			if err != nil {
				return fmt.Errorf("failed to create Kubernetes client: %v", err)
			}
			ns := ctx.NamespaceOrDefault(ctx.Namespace())
			// If a user decides to enroll their namespace with a waypoint, verify that they have labeled their namespace as ambient.
			// If they don't, the user will be warned and be presented with the command to label their namespace as ambient if they
			// choose to do so.
			//

		Long: `Remove Istio control plane revision tag.

Removing a revision tag should be done with care. Removing a revision tag will disrupt sidecar injection in namespaces
that reference the tag in an "istio.io/rev" label. Verify that there are no remaining namespaces referencing a
revision tag before removing using the "istioctl tag list" command.
`,
		Example: `  # Remove the revision tag "prod"
  istioctl tag remove prod
`,