// Insert jumps to our custom chains
	// This is mostly just for visual tidiness and cleanup, as we can delete the secondary chains and jumps
	// without polluting the main table too much.

	// -t mangle -A PREROUTING -j ISTIO_PRERT
	iptablesBuilder.AppendRule(
		iptableslog.UndefinedCommand, iptablesconstants.PREROUTING, iptablesconstants.MANGLE,
		"-j", ChainInpodPrerouting,
	)

  // Default is false.
  // Note that this field cannot be set when spec.os.name is windows.
  // +optional
  optional bool readOnlyRootFilesystem = 6;

  // AllowPrivilegeEscalation controls whether a process can gain more
  // privileges than its parent process. This bool directly controls if
  // the no_new_privs flag will be set on the container process.
  // AllowPrivilegeEscalation is true always when the container is:

			if err != nil {
				err = fmt.Errorf("%s: %w", cleanErr.Error(), err)
			} else {
				err = cleanErr
			}
		}

		return
	},
}

// GetCommand returns the main cobra.Command object for this application
func GetCommand() *cobra.Command {
	return rootCmd
}

func init() {
	viper.AutomaticEnv()
	viper.AllowEmptyEnv(true)

          - pkg: slices
            desc: "do not use slices; use istio.io/istio/pkg/slices instead"
      DenyOperatorAndIstioctl:
        files:
          # Tests can do anything
          - "!$test"
          # Main code should only be used by appropriate binaries
          - "!**/operator/**"
          - "!**/istioctl/**"
          - "!**/tools/bug-report/**"

  // will not be forced to.
  // +optional
  optional bool readOnlyRootFilesystem = 14;

  // defaultAllowPrivilegeEscalation controls the default setting for whether a
  // process can gain more privileges than its parent process.
  // +optional
  optional bool defaultAllowPrivilegeEscalation = 15;

  // allowPrivilegeEscalation determines if a pod can request to allow

          "showLineNumbers": false,
          "showMiniMap": false
        },

			"where logger components can be listed by running \"istioctl proxy-config log <pod-name[.namespace]>\""+
			"or referred from https://github.com/envoyproxy/envoy/blob/main/source/common/common/logger.h, and level can be one of %s", levelListString))
	return logCmd
}

func routeConfigCmd(ctx cli.Context) *cobra.Command {
	var podName, podNamespace string

### Overview

- [istio-cni Helm chart](../manifests/charts/istio-cni/templates)
    - `install-cni` daemonset - main function is to install and help the node CNI, but it is also a proper server and interacts with K8S, watching Pods for recovery.
    - `istio-cni-config` configmap with CNI plugin config to add to CNI plugin chained config

	}
	return typ, nil
}

// Wrapper is a wrapper around the Envoy ConfigDump
// It has extra helper functions for handling any/struct/marshal protobuf pain
type Wrapper struct {
	*admin.ConfigDump
}

// UnmarshalJSON is a custom unmarshaller to handle protobuf pain
func (w *Wrapper) UnmarshalJSON(b []byte) error {
	cd := &admin.ConfigDump{}
	err := protomarshal.UnmarshalAllowUnknownWithAnyResolver(nonStrictResolver, b, cd)

            },
            "last_updated": "2024-03-04T08:37:44.851Z"
          }
        },
        {
          "name": "main_internal",
          "active_state": {
            "listener": {
              "@type": "type.googleapis.com/envoy.config.listener.v3.Listener",
              "name": "main_internal",
              "filter_chains": [
                {
                  "filters": [
                    {