configCmd := &cobra.Command{
		Use:   "proxy-config",
		Short: "Retrieve information about proxy configuration from Envoy [kube only]",
		Long:  `A group of commands used to retrieve information about proxy configuration from the Envoy config dump`,
		Example: `  # Retrieve information about proxy configuration from an Envoy instance.

Istio base successfully installed!

To learn more about the release, try:
  $ helm status {{ .Release.Name }} -n {{ .Release.Namespace }}

"{{ include "gateway.name" . }}" successfully installed!

To learn more about the release, try:
  $ helm status {{ .Release.Name }} -n {{ .Release.Namespace }}
  $ helm get all {{ .Release.Name }} -n {{ .Release.Namespace }}

Next steps:
  * Deploy an HTTP Gateway: https://istio.io/latest/docs/tasks/traffic-management/ingress/ingress-control/

The `Workload` aims to represent everything about a workload (generally a `Pod` or `WorkloadEntry`).
This includes things like its IP address, identity, metadata (name, namespace, app, version, etc), and whether it has a waypoint proxy associated.

The `Service` aims to represent everything about a service (generally a `Service` or `ServiceEntry`).

"istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}" successfully installed!

To learn more about the release, try:
  $ helm status {{ .Release.Name }} -n {{ .Release.Namespace }}
  $ helm get all {{ .Release.Name }} -n {{ .Release.Namespace }}

Next steps:
{{- if (eq .Values.profile "ambient") }}
  * Get started with ambient: https://istio.io/latest/docs/ops/ambient/getting-started/

ztunnel successfully installed!

To learn more about the release, try:
  $ helm status {{ .Release.Name }} -n {{ .Release.Namespace }}

"{{ .Release.Name }}" successfully installed!

To learn more about the release, try:
  $ helm status {{ .Release.Name }} -n {{ .Release.Namespace }}

## Reference

### Design details

Broadly, `istio-cni` accomplishes ambient redirection by instructing ztunnel to set up sockets within the application pod network namespace, where:

	@mkdir -p ${TARGET_OUT}/logs
	@mkdir -p ${TARGET_OUT}/release

# I tried to make this dependent on what I thought was the appropriate
# lock file, but it caused the rule for that file to get run (which
# seems to be about obtaining a new version of the 3rd party libraries).
$(TARGET_OUT)/istio_is_init: bin/init.sh istio.deps | $(TARGET_OUT)
	@# Add a retry, as occasionally we see transient connection failures to GCS

                      description: Fault injection policy to apply on HTTP traffic
                        at the client side.
                      properties:
                        abort:
                          description: Abort Http request attempts and return error
                            codes back to downstream service, giving the impression
                            that the upstream service is faulty.