}

	rootCmd.AddCommand(experimentalCmd)
	rootCmd.AddCommand(proxyconfig.ProxyConfig(ctx))
	rootCmd.AddCommand(admin.Cmd(ctx))
	experimentalCmd.AddCommand(injector.Cmd(ctx))

	rootCmd.AddCommand(mesh.UninstallCmd(ctx))

	experimentalCmd.AddCommand(authz.AuthZ(ctx))
	rootCmd.AddCommand(seeExperimentalCmd("authz"))
	experimentalCmd.AddCommand(metrics.Cmd(ctx))
	experimentalCmd.AddCommand(describe.Cmd(ctx))

	dashboardCmd.AddCommand(graf)

	jaeger := jaegerDashCmd(cliContext)
	jaeger.PersistentFlags().IntVar(&jaegerPort, "ui-port", defaultJaegerPort, "The component dashboard UI port.")
	dashboardCmd.AddCommand(jaeger)

	zipkin := zipkinDashCmd(cliContext)
	zipkin.PersistentFlags().IntVar(&zipkinPort, "ui-port", defaultZipkinPort, "The component dashboard UI port.")
	dashboardCmd.AddCommand(zipkin)

	configCmd.AddCommand(clusterConfigCmd(ctx))
	configCmd.AddCommand(allConfigCmd(ctx))
	configCmd.AddCommand(listenerConfigCmd(ctx))
	configCmd.AddCommand(logCmd(ctx))
	configCmd.AddCommand(routeConfigCmd(ctx))
	configCmd.AddCommand(bootstrapConfigCmd(ctx))
	configCmd.AddCommand(endpointConfigCmd(ctx))
	configCmd.AddCommand(edsConfigCmd(ctx))
	configCmd.AddCommand(secretConfigCmd(ctx))

  istioctl ztunnel-config certificates`,
		Aliases: []string{"zc"},
	}

	configCmd.AddCommand(logCmd(ctx))
	configCmd.AddCommand(workloadConfigCmd(ctx))
	configCmd.AddCommand(certificatesConfigCmd(ctx))
	configCmd.AddCommand(servicesCmd(ctx))
	configCmd.AddCommand(policiesCmd(ctx))
	configCmd.AddCommand(allCmd(ctx))
	configCmd.AddCommand(connectionsCmd(ctx))

	return configCmd
}

type Command struct {
	Name string
}

	waypointGenerateCmd.Flags().StringVarP(&revision, "revision", "r", "", "The revision to label the waypoint with")
	waypointCmd.AddCommand(waypointGenerateCmd)
	waypointCmd.AddCommand(waypointDeleteCmd)
	waypointCmd.AddCommand(waypointListCmd)
	waypointCmd.AddCommand(waypointApplyCmd)
	waypointCmd.AddCommand(waypointStatusCmd)

	viper.AllowEmptyEnv(true)
	viper.SetEnvKeyReplacer(strings.NewReplacer("-", "_"))
	logOptions.AttachCobraFlags(rootCmd)
	ctrlzOptions.AttachCobraFlags(rootCmd)

	rootCmd.AddCommand(version.CobraCommand())
	rootCmd.AddCommand(collateral.CobraCommand(rootCmd, collateral.Metadata{
		Title:   "Istio CNI Plugin Installer",
		Section: "install-cni CLI",
		Manual:  "Istio CNI Plugin Installer",
	}))

			}
			return nil
		},
		RunE: func(cmd *cobra.Command, args []string) error {
			cmd.HelpFunc()(cmd, args)
			return nil
		},
	}

	cmd.AddCommand(tagSetCommand(ctx))
	cmd.AddCommand(tagGenerateCommand(ctx))
	cmd.AddCommand(tagListCommand(ctx))
	cmd.AddCommand(tagRemoveCommand(ctx))

	return cmd
}

func tagSetCommand(ctx cli.Context) *cobra.Command {
	cmd := &cobra.Command{

		Example: `  # workload group yaml generation
  istioctl x workload group create

  # workload entry configuration generation
  istioctl x workload entry configure`,
	}
	workloadCmd.AddCommand(groupCommand(ctx))
	workloadCmd.AddCommand(entryCommand(ctx))
	return workloadCmd
}

func groupCommand(ctx cli.Context) *cobra.Command {
	groupCmd := &cobra.Command{
		Use:     "group",

func AuthZ(ctx cli.Context) *cobra.Command {
	cmd := &cobra.Command{
		Use:   "authz",
		Short: "Inspect Istio AuthorizationPolicy",
	}

	cmd.AddCommand(checkCmd(ctx))
	cmd.Long += "\n\n" + util.ExperimentalMsg
	return cmd

				return fmt.Errorf("unknown subcommand %q", args[0])
			}
			return nil
		},
		RunE: func(cmd *cobra.Command, args []string) error {
			cmd.HelpFunc()(cmd, args)
			return nil
		},
	}

	cmd.AddCommand(injectorListCommand(cliContext))
	return cmd
}

func injectorListCommand(ctx cli.Context) *cobra.Command {
	var opts clioptions.ControlPlaneOptions
	cmd := &cobra.Command{
		Use:     "list",