rootCmd.AddCommand(dashboardCmd)

	manifestCmd := mesh.ManifestCmd(ctx)
	hideInheritedFlags(manifestCmd, cli.FlagNamespace, cli.FlagIstioNamespace, FlagCharts)
	rootCmd.AddCommand(manifestCmd)

	operatorCmd := mesh.OperatorCmd(ctx)
	hideInheritedFlags(operatorCmd, cli.FlagNamespace, cli.FlagIstioNamespace, FlagCharts)
	rootCmd.AddCommand(operatorCmd)

	installCmd := mesh.InstallCmd(ctx)

          {{- if $.Values.global.meshID }}
          - name: ISTIO_META_MESH_ID
            value: "{{ $.Values.global.meshID }}"
          {{- else if .Values.meshConfig.trustDomain }}
          - name: ISTIO_META_MESH_ID
            value: "{{ .Values.meshConfig.trustDomain }}"
          {{- end }}
          {{- if .Values.meshConfig.trustDomain }}

	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
	"sigs.k8s.io/yaml"

	"istio.io/api/annotation"
	"istio.io/api/label"
	meshconfig "istio.io/api/mesh/v1alpha1"
	networkingv1alpha3 "istio.io/api/networking/v1alpha3"
	clientv1alpha3 "istio.io/client-go/pkg/apis/networking/v1alpha3"
	"istio.io/istio/istioctl/pkg/cli"
	"istio.io/istio/istioctl/pkg/clioptions"

		if err != nil {
			fmt.Printf("Error getting configmap %s: %v\n", configMapName, err)
		}
		meshData := make(map[string]interface{})
		if data, exists := configMap.Data["mesh"]; exists {
			if err := yaml.Unmarshal([]byte(data), &meshData); err != nil {
				fmt.Printf("Error parsing meshConfig: %v\n", err)
				return err
			}
		}

As ztunnel aims to transparently encrypt and route users traffic, we need a mechanism to capture all traffic entering and leaving "mesh" pods.
This is a security critical task: if the ztunnel can be bypassed, authorization policies can be bypassed.

Redirection must meet these requirements:
* All traffic *egressing* a pod in the mesh should be redirected to the node-local ztunnel on port 15001.

- watches k8s resource for existing pods, so that pods that have already been started can be moved in or out of the ambient mesh.
- sends UDS events to ztunnel via a socket whenever a pod is enabled for ambient mesh (whether from CNI plugin or node watcher), instructing ztunnel to create the "tube" socket.

		CNIMode:          false, // we are in cni, but as we do the netns ourselves, we should keep this as false.
		NetworkNamespace: "",
	}
}

// Remove pod from mesh: pod is not deleted, we just want to remove it from the mesh.
func (s *NetServer) RemovePodFromMesh(ctx context.Context, pod *corev1.Pod) error {
	log := log.WithLabels("ns", pod.Namespace, "name", pod.Name)
	log.Debugf("Pod is now opt out... cleaning up.")

    --from-file=istio-workload-dashboard.json="${TMP}/istio-workload-dashboard.json" \
    --from-file=istio-service-dashboard.json="${TMP}/istio-service-dashboard.json" \
    --from-file=istio-mesh-dashboard.json="${TMP}/istio-mesh-dashboard.json" \
    --from-file=istio-extension-dashboard.json="${TMP}/istio-extension-dashboard.json"
} > "${ADDONS}/grafana.yaml"

# Set up loki
{
  helm3 template loki loki \

		Use:   "proxy-status [<type>/]<name>[.<namespace>]",
		Short: "Retrieves the synchronization status of each Envoy in the mesh",
		Long: `
Retrieves last sent and last acknowledged xDS sync from Istiod to each Envoy in the mesh
`,
		Example: `  # Retrieve sync status for all Envoys in a mesh
  istioctl proxy-status

  # Retrieve sync status for Envoys in a specific namespace
  istioctl proxy-status --namespace foo

	if err != nil {
		log.Errorf("failed to remove pod from mesh: %v", err)
		return err
	}
	log.Debug("removing annotation from pod")
	err = util.AnnotateUnenrollPod(s.kubeClient, &pod.ObjectMeta)
	if err != nil {
		log.Errorf("failed to annotate pod unenrollment: %v", err)
	}
	return err
}

// Delete pod from mesh: pod is deleted. iptables rules will die with it, we just need to update ztunnel