return fmt.Errorf("config writer has not been primed")
	}

	dump, err := c.configDump.GetEcdsConfigDump()
	if err != nil {
		return err
	}

	out, err := protomarshal.MarshalIndentWithGlobalTypesResolver(dump, "    ")
	if err != nil {
		return err
	}
	if outputFormat == "yaml" {
		if out, err = yaml.JSONToYAML(out); err != nil {
			return err
		}
	}
	_, _ = fmt.Fprintln(c.Stdout, string(out))
	return nil
}

)

func GetRevisionWebhooks(ctx context.Context, client kubernetes.Interface) ([]admitv1.MutatingWebhookConfiguration, error) {
	webhooks, err := client.AdmissionregistrationV1().MutatingWebhookConfigurations().List(ctx, metav1.ListOptions{
		LabelSelector: label.IoIstioRev.Name,
	})
	if err != nil {
		return nil, err
	}
	return webhooks.Items, nil
}

// GetWebhooksWithTag returns webhooks tagged with istio.io/tag=<tag>.

	ret := map[string]string{
		"x-goog-user-project": c.project,
	}
	if err := updateAuthHdrs(ctx, uri, "k8s", c.k8sCreds, ret, "x-mesh-authorization"); err != nil {
		return nil, err
	}
	if err := updateAuthHdrs(ctx, uri, "gcp", c.gcpCreds, ret, "authorization"); err != nil {
		return nil, err
	}
	return ret, nil
}

func (*meshAuthCredentials) RequireTransportSecurity() bool {
	return true
}

	loopbackLink, err := netlink.LinkByName("lo")
	if err != nil {
		return fmt.Errorf("failed to find 'lo' link: %v", err)
	}

	// Set up netlink routes for localhost
	cidrs := []string{"0.0.0.0/0"}
	if cfg.EnableIPv6 {
		cidrs = append(cidrs, "0::0/0")
	}
	for _, fullCIDR := range cidrs {
		_, localhostDst, err := net.ParseCIDR(fullCIDR)
		if err != nil {
			return fmt.Errorf("parse CIDR: %v", err)

	wrapper *configdump.Wrapper,
) ([]SecretItem, error) {
	secretConfigDump, err := wrapper.GetSecretConfigDump()
	if err != nil {
		return nil, err
	}

	proxySecretItems := make([]SecretItem, 0)
	for _, warmingSecret := range secretConfigDump.DynamicWarmingSecrets {
		secret, err := parseDynamicSecret(warmingSecret, "WARMING")
		if err != nil {
			return nil, fmt.Errorf("failed building warming secret %s: %v",

				cw.Prime(cd)
			}
			err := cw.PrintBootstrapDump("json")
			if tt.wantOutputFile != "" {
				util.CompareContent(t, gotOut.Bytes(), tt.wantOutputFile)
			}
			if err == nil && tt.wantErr {
				t.Errorf("PrintBootstrapDump (%v) did not produce expected err", tt.name)
			} else if err != nil && !tt.wantErr {
				t.Errorf("PrintBootstrapDump (%v) produced unexpected err: %v", tt.name, err)
			}
		})
	}
}

func (w *Wrapper) GetListenerConfigDump() (*admin.ListenersConfigDump, error) {
	listenerDumpAny, err := w.getSection(listeners)
	if err != nil {
		return nil, err
	}
	listenerDump := &admin.ListenersConfigDump{}
	err = listenerDumpAny.UnmarshalTo(listenerDump)
	if err != nil {
		return nil, err
	}
	return listenerDump, nil

)

func TestCNIListener(t *testing.T) {
	f := filepath.Join(t.TempDir(), "test")
	l, err := NewListener(f)
	if err != nil {
		t.Fatalf("unexpected error %v", err)
	}
	defer l.Close()
	conn, err := connect(f)
	if err != nil {
		t.Fatalf("failed to connect %v", err)
	}
	conn.Close()
}

func connect(socket string) (*grpc.ClientConn, error) {
	var opts []grpc.DialOption

	}

	y, _, err := manifest.GenerateConfig(pdArgs.inFilenames, setFlags, true, nil, l)
	if err != nil {
		return err
	}
	y, err = tpath.GetConfigSubtree(y, "spec")
	if err != nil {
		return err
	}

	if pdArgs.configPath == "" {
		if y, err = prependHeader(y); err != nil {
			return err
		}
	} else {
		if y, err = tpath.GetConfigSubtree(y, pdArgs.configPath); err != nil {

	var retErr error
	err := s.netServer.AddPodToMesh(ctx, pod, podIPs, netNs)
	if err != nil {
		log.Errorf("failed to add pod to ztunnel: %v", err)
		if !errors.Is(err, ErrPartialAdd) {
			return err
		}
		retErr = err
	}

	log.Debugf("annotating pod %s", pod.Name)
	if err := util.AnnotateEnrolledPod(s.kubeClient, &pod.ObjectMeta); err != nil {