tcpTLS             = []string{"istio-peer-exchange", "istio"}

	protDescrs = map[string][]string{
		"App: HTTP TLS":         httpTLS,
		"App: Istio HTTP Plain": istioHTTPPlaintext,
		"App: TCP TLS":          tcpTLS,
		"App: HTTP":             plaintextHTTPALPNs,
	}
)

func retrieveListenerMatches(l *listener.Listener) []filterchain {
	fChains := getFilterChains(l)

				" --annotations annotation=foobar --ports grpc=3550,http=8080 --serviceAccount test", " "),
			expectedException: false,
			expectedOutput:    customYAML,
		},
		{
			description: "valid case - create full workload group with shortnames",
			args: strings.Split("group create --name foo -n bar -l app=foo,bar=baz -p grpc=3550,http=8080"+

  istioctl x check-inject deployment/details-v1 -n test

  # Check the injection status of label pairs in a specific namespace before actual injection 
  istioctl x check-inject -n test -l app=helloworld,version=v1
`,
		Args: func(cmd *cobra.Command, args []string) error {
			if len(args) == 0 && labelPairs == "" || len(args) > 1 {
				cmd.Println(cmd.UsageString())

	labelSelector := centralOpts.XdsPodLabel
	if labelSelector == "" {
		labelSelector = "app=istiod"
	}
	pods, err := kubeClient.GetIstioPods(context.TODO(), istioNamespace, metav1.ListOptions{
		LabelSelector: labelSelector,
		FieldSelector: kube.RunningStatus,
	})
	if err != nil {
		return nil, err

	cniConf := buildMockConf(true, url)

	pod, ns := buildFakePodAndNSForClient()

	proxy := corev1.Container{Name: "istio-proxy"}
	app := corev1.Container{Name: "app"}

	pod.Spec.Containers = []corev1.Container{app, proxy}
	pod.ObjectMeta.Annotations = map[string]string{annotation.SidecarStatus.Name: "true"}

			client, err := ctx.CLIClientWithRevision(opts.Revision)
			if err != nil {
				return fmt.Errorf("failed to create k8s client: %v", err)
			}

			name, namespace, err := inferPodMeta(ctx, client, "app.kubernetes.io/name=prometheus")
			if err != nil {
				return err
			}
			return portForward(name, namespace, "Prometheus",
				"http://%s", bindAddress, promPort, client, cmd.OutOrStdout(), browser)
		},
	}

	if client == nil {
		return isZtunnel
	}
	pod, err := client.Kube().CoreV1().Pods(podNamespace).Get(context.Background(), podName, metav1.GetOptions{})
	if err != nil {
		return isZtunnel
	}
	if v, ok := pod.Labels["app"]; ok {
		return v == "ztunnel"
	}
	return isZtunnel
}

// InAmbient returns true if a resource is in ambient data plane mode.
func InAmbient(obj metav1.Object) bool {
	if obj == nil {
		return false
	}

		iptableslog.UndefinedCommand, ChainInpodOutput, iptablesconstants.NAT,
		"-d", hostProbeSNAT.String(),
		"-p", "tcp",
		"-m", "tcp",
		"-j", "ACCEPT",
	)

	// prevent intercept traffic from app ==> app by pod ip
	iptablesBuilder.AppendVersionedRule("127.0.0.1/32", "::1/128",
		iptableslog.UndefinedCommand, ChainInpodPrerouting, iptablesconstants.MANGLE,

		return nil
	}
	mwhs, err := client.Kube().AdmissionregistrationV1().MutatingWebhookConfigurations().List(context.Background(), metav1.ListOptions{
		LabelSelector: "app=sidecar-injector,istio.io/rev=default,istio.io/tag=default",
	})
	if err != nil {
		return err
	}
	// If there is no default webhook but a revisioned default webhook exists,

			WantException:  true,
		},
		{ // case 9
			Args:           strings.Split("prometheus --browser=false", " "),
			ExpectedOutput: "Error: no pods found with selector app.kubernetes.io/name=prometheus\n",
			WantException:  true,
		},
		{ // case 10
			Args:           strings.Split("zipkin --browser=false", " "),
			ExpectedOutput: "Error: no pods found with selector app=zipkin\n",