return false
		}
	}

	return true
}

// PrintServiceSummary prints a summary of the relevant services in the config dump to the ConfigWriter stdout
func (c *ConfigWriter) PrintServiceSummary(filter ServiceFilter) error {
	w := c.tabwriter()
	zDump := c.ztunnelDump

	svcs := slices.Filter(maps.Values(zDump.Services), filter.Verify)
	slices.SortFunc(svcs, func(a, b *ZtunnelService) int {

	return nil
}

func waypointName(wl *ZtunnelWorkload, services map[string]*ZtunnelService) string {
	if wl.Waypoint == nil {
		return "None"
	}

	if svc, ok := services[wl.Waypoint.Destination]; ok {
		return svc.Name
	}

	return "NA" // Shouldn't normally reach here
}

func serviceWaypointName(svc *ZtunnelService, services map[string]*ZtunnelService) string {
	if svc.Waypoint == nil {

	// The format of each renaming pair is A->B, all renaming pairs are comma separated.
	// e.g. Service:*:istio-pilot->Service:*:istio-control - rename istio-pilot service into istio-control
	renameResources string
}

func addManifestDiffFlags(cmd *cobra.Command, diffArgs *manifestDiffArgs) {
	cmd.PersistentFlags().BoolVarP(&diffArgs.compareDir, "directory", "r",
		false, "Compare directory.")

		if !strings.EqualFold(pol.Namespace, wf.Namespace) {
			return false
		}
	}

	return true
}

// PrintServiceSummary prints a summary of the relevant services in the config dump to the ConfigWriter stdout
func (c *ConfigWriter) PrintPolicySummary(filter PolicyFilter) error {
	w := c.tabwriter()
	zDump := c.ztunnelDump

	pols := slices.Filter(maps.Values(zDump.Policies), filter.Verify)

	serviceList, err := client.Kube().CoreV1().Services(ns).List(context.Background(), metav1.ListOptions{})
	if err != nil {
		return nil, err
	}

	var serviceNameList []string
	for _, service := range serviceList.Items {
		if toComplete == "" || strings.HasPrefix(service.Name, toComplete) {
			serviceNameList = append(serviceNameList, service.Name)
		}
	}

	return serviceNameList, nil
}

// via the nodeIP
// - kubelet (node-local healthchecks, which we do not capture)
// - kube-proxy (fowarded/proxied traffic from LoadBalancer-backed services, potentially with public IPs, which we must capture)
func (cfg *IptablesConfigurator) CreateHostRulesForHealthChecks(hostSNATIP, hostSNATIPV6 *netip.Addr) error {
	// Append our rules here

  # Validate current deployments under 'default' namespace within the cluster
  kubectl get deployments -o yaml | istioctl validate -f -

  # Validate current services under 'default' namespace within the cluster
  kubectl get services -o yaml | istioctl validate -f -

  # Also see the related command 'istioctl analyze'
  istioctl analyze samples/bookinfo/networking/bookinfo-gateway.yaml
`,
		Args: cobra.NoArgs,

func (c *ConfigWriter) PrintConnectionsSummary(filter ConnectionsFilter) error {
	w := c.tabwriter()
	d := c.ztunnelDump
	serviceNames := map[string]string{}
	workloadNames := map[string]string{}
	for netIP, s := range d.Services {
		_, ip, _ := strings.Cut(netIP, "/")
		serviceNames[ip] = s.Hostname
	}
	for netIP, s := range d.Workloads {
		_, ip, _ := strings.Cut(netIP, "/")
		workloadNames[ip] = s.Name + "." + s.Namespace
	}

			wantNamespace: "istio-system",
		},
		{
			proxyName:     "service/istiod",
			namespace:     "",
			wantPodName:   "service/istiod",
			wantNamespace: "",
		},
		{
			proxyName:     "service/istiod",
			namespace:     "namespace",
			wantPodName:   "service/istiod",
			wantNamespace: "namespace",
		},
		{
			proxyName:     "service/istiod.istio-system",
			namespace:     "namespace",

import (
	"context"
	"encoding/json"
	"errors"
	"fmt"
	"io"
	"net"
	"net/url"
	"os"
	"strings"

	discovery "github.com/envoyproxy/go-control-plane/envoy/service/discovery/v3"
	xdsstatus "github.com/envoyproxy/go-control-plane/envoy/service/status/v3"
	"google.golang.org/grpc"
	v1 "k8s.io/api/core/v1"
	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"

	"istio.io/api/label"
	"istio.io/istio/istioctl/pkg/clioptions"