maxUnavailable: {{ $gateway.rollingMaxUnavailable }}
  template:
    metadata:
      labels:
{{ $gateway.labels | toYaml | indent 8 }}
{{- if eq .Release.Namespace "istio-system"}}
        heritage: Tiller
        release: istio
        chart: gateways
{{- end }}
        install.operator.istio.io/owning-resource: {{ .Values.ownerName | default "unknown" }}
        operator.istio.io/component: "IngressGateways"

      maxUnavailable: {{ $gateway.rollingMaxUnavailable }}
  template:
    metadata:
      labels:
{{ $gateway.labels | toYaml | indent 8 }}
{{- if eq .Release.Namespace "istio-system"}}
        heritage: Tiller
        release: istio
        chart: gateways
{{- end }}
        install.operator.istio.io/owning-resource: {{ .Values.ownerName | default "unknown" }}
        operator.istio.io/component: "EgressGateways"

}

// PrintServiceSummary prints a summary of the relevant services in the config dump to the ConfigWriter stdout
func (c *ConfigWriter) PrintServiceSummary(filter ServiceFilter) error {
	w := c.tabwriter()
	zDump := c.ztunnelDump

	svcs := slices.Filter(maps.Values(zDump.Services), filter.Verify)
	slices.SortFunc(svcs, func(a, b *ZtunnelService) int {
		if r := cmp.Compare(a.Namespace, b.Namespace); r != 0 {
			return r
		}

	"fmt"
	"sort"
	"strings"

	"sigs.k8s.io/yaml"
)

// WorkloadFilter is used to pass filter information into workload based config writer print functions
type WorkloadFilter struct {
	Address   string
	Node      string
	Verbose   bool
	Namespace string
}

// Verify returns true if the passed workload matches the filter fields
func (wf *WorkloadFilter) Verify(workload *ZtunnelWorkload) bool {

			return r
		}
		return cmp.Compare(a.Info.Namespace, b.Info.Namespace)
	})
	for _, wl := range workloads {
		if filter.Namespace != "" && filter.Namespace != wl.Info.Namespace {
			continue
		}
		name := fmt.Sprintf("%s.%s", wl.Info.Name, wl.Info.Namespace)
		if filter.Direction != "outbound" {
			for _, c := range wl.Connections.Inbound {

            (has(object.spec.metrics) ? object.spec.metrics : {}).exists(m, has(m.reportingInterval)) ||
            (has(object.spec.accessLogging) ? object.spec.accessLogging : {}).exists(l, has(l.filter))
          )
        )
---
apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingAdmissionPolicyBinding
metadata:
  name: "stable-channel-default-policy-binding.istio.io"
spec:

		controllers.WithGenericReconciler(s.reconcile),
		controllers.WithMaxAttempts(5),
	)
	// We only need to handle pods on our node
	s.pods = kclient.NewFiltered[*corev1.Pod](kubeClient, kclient.Filter{FieldSelector: "spec.nodeName=" + NodeName})
	s.pods.AddEventHandler(controllers.FromEventHandler(func(o controllers.Event) {
		s.queue.Add(o)
	}))

	// Namespaces could be anything though, so we watch all of those
	//

}

// PrintServiceSummary prints a summary of the relevant services in the config dump to the ConfigWriter stdout
func (c *ConfigWriter) PrintPolicySummary(filter PolicyFilter) error {
	w := c.tabwriter()
	zDump := c.ztunnelDump

	pols := slices.Filter(maps.Values(zDump.Policies), filter.Verify)
	slices.SortFunc(pols, func(a, b *ZtunnelPolicy) int {
		if r := cmp.Compare(a.Namespace, b.Namespace); r != 0 {
			return r
		}

		}
	}
	return "unknown"
}

func (c *ConfigWriter) PrintEndpoints(filter EndpointFilter, outputFormat string) error {
	if c.configDump == nil {
		return fmt.Errorf("config writer has not been primed")
	}
	dump, err := c.retrieveSortedEndpointsSlice(filter)
	if err != nil {
		return err
	}
	marshaller := make(proto.MessageSlice, 0, len(dump))
	for _, eds := range dump {

            (has(object.spec.metrics) ? object.spec.metrics : {}).exists(m, has(m.reportingInterval)) ||
            (has(object.spec.accessLogging) ? object.spec.accessLogging : {}).exists(l, has(l.filter))
          )
        )
---
apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingAdmissionPolicyBinding
metadata: