if err != nil {
			return false
		}
		name := r.Name
		err = drc[j].RouteConfig.UnmarshalTo(r)
		if err != nil {
			return false
		}
		return name < r.Name
	})

	// In Istio 1.5, it is not enough just to sort the routes.  The virtual hosts
	// within a route might have a different order.  Sort those too.
	for i := range drc {
		route := &route.RouteConfiguration{}
		err = drc[i].RouteConfig.UnmarshalTo(route)

			// something first, we expect to get an os.ErrDeadlineExceeded error
			// here if the connection is still alive.
			// note that unlike tcp connections, reading is a good enough test here.
			_, err := conn.readMessage(time.Second / 100)
			switch {
			case !errors.Is(err, os.ErrDeadlineExceeded):
				log.Debugf("ztunnel keepalive failed: %v", err)
				if errors.Is(err, io.EOF) {

  optional MetricValueStatus current = 2;

  // container is the name of the container in the pods of the scaling target
  optional string container = 3;
}

// CrossVersionObjectReference contains enough information to let you identify the referred resource.
message CrossVersionObjectReference {

  // container is the name of the container in the pods of the scaling target
  optional string container = 4;
}

// CrossVersionObjectReference contains enough information to let you identify the referred resource.
message CrossVersionObjectReference {
  // Kind of the referent; More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds

// kubelet plugin registration.
// CSINode has the same name as a node. If the object is missing, it means either
// there are no CSI Drivers available on the node, or the Kubelet version is low
// enough that it doesn't create this object.
// CSINode has an OwnerReference that points to the corresponding node object.
message CSINode {
  // Standard object's metadata.
  // metadata.name must be the Kubernetes node name.

  // Traffic intended for the service should be sent to these ingress points.
  // +optional
  repeated LoadBalancerIngress ingress = 1;
}

// LocalObjectReference contains enough information to let you locate the
// referenced object inside the same namespace.
// +structType=atomic
message LocalObjectReference {
  // Name of the referent.

  // +optional
  optional string selectedNode = 1;

  // PotentialNodes lists nodes where the Pod might be able to run.
  //
  // The size of this field is limited to 128. This is large enough for
  // many clusters. Larger clusters may need more attempts to find a node
  // that suits all pending resources. This may get increased in the
  // future, but not reduced.
  //
  // +listType=set
  // +optional

	if err != nil {
		return "", "", err
	}
	if podName != "" {
		return podName, namespace, nil
	}
	// We need to pass in a sorter, and the one used by `kubectl logs` is good enough.
	sortBy := func(pods []*corev1.Pod) sort.Interface { return podutils.ByLogging(pods) }
	timeout := 2 * time.Second
	if getFirstPodFunc == nil {
		getFirstPodFunc = polymorphichelpers.GetFirstPod
	}

  // It is entirely possible to get an error and be able to continue determine authorization status in spite of it.
  // For instance, RBAC can be missing a role, but enough roles are still present and bound to reason about the request.
  // +optional
  optional string evaluationError = 3;
}

package kubeinject

import (
	"context"
	"fmt"
	"net/http"
	"strings"

	"golang.org/x/oauth2"
	"golang.org/x/oauth2/google"
)

func isMCPAddr(addr string) bool {
	// A bit inexact but should be good enough.
	return strings.Contains(addr, ".googleapis.com/") || strings.Contains(addr, ".googleapis.com:443/")
}

func mcpTransport(ctx context.Context, tr http.RoundTripper) (http.RoundTripper, error) {