property-sort-order: 0
  property-units: 2
  pseudo-element: 2
  quotes:
    - 2
    -
      style: double
  shorthand-values: 2
  single-line-per-selector: 0
  space-after-bang: 2
  space-after-colon: 2
  space-after-comma: 2
  space-around-operator: 2
  space-before-bang: 2
  space-before-brace: 2
  space-before-colon: 2
  space-between-parens: 2
  trailing-semicolon: 2
  url-quotes: 2

  // as having been marked for deletion (or after a timeout). The key in the map is the name of the pod
  // and the value is the time when the API server processed the eviction request. If
  // the deletion didn't occur and a pod is still there it will be removed from
  // the list automatically by PodDisruptionBudget controller after some time.

* All code merged in after the feature freeze must have an associated GitHub issue and a release note (exception for
  unit and integration test changes).
    * The release managers may not know of all the features being worked on for an Istio release. Developers must
      make their case as to why their PR should be merged.
* Developers submitting PRs after the code freeze and after the first release candidate must provide justification

	}
	secretDump := c.ztunnelDump.Certificates
	w := new(tabwriter.Writer).Init(c.Stdout, 0, 8, 5, ' ', 0)
	fmt.Fprintln(w, "CERTIFICATE NAME\tTYPE\tSTATUS\tVALID CERT\tSERIAL NUMBER\tNOT AFTER\tNOT BEFORE")

	for _, secret := range secretDump {
		if strings.Contains(secret.State, "Unavailable") {
			secret.State = "Unavailable"
		}
		if len(secret.CertChain) == 0 {

	AllOperatorRevFlagHelpStr = `Remove all versions of Istio operator.`
	ComponentFlagHelpStr      = "Specify which component to generate manifests for."
	VerifyCRInstallHelpStr    = "Verify the Istio control plane after installation/in-place upgrade"
)

type RootArgs struct {
	// DryRun performs all steps except actually applying the manifests or creating output dirs/files.
	DryRun bool
}

     either this License or such Secondary License(s).

3.4. Notices

     You may not remove or alter the substance of any license notices (including
     copyright notices, patent notices, disclaimers of warranty, or limitations
     of liability) contained within the Source Code Form of the Covered
     Software, except that You may alter any license notices to the extent
     required to remedy known factual inaccuracies.

	}
	return err
}

var (
	secretItemColumns = []string{"RESOURCE NAME", "TYPE", "STATUS", "VALID CERT", "SERIAL NUMBER", "NOT AFTER", "NOT BEFORE"}
	secretDiffColumns = []string{"RESOURCE NAME", "TYPE", "VALID CERT", "NODE AGENT", "PROXY", "SERIAL NUMBER", "NOT AFTER", "NOT BEFORE"}
)

// printSecretItemsTabular prints the secret in table format
func (w *sdsWriter) printSecretItemsTabular(secrets []SecretItem) error {

					}
					t.Fatalf("did not expect to retrieve a CNI config file %s", result)
				}
				// Successful test for non-delayed cases
				return
			case err := <-errChan:
				t.Fatal(err)
			case <-time.After(250 * time.Millisecond):
				if len(c.delayedConfName) > 0 {
					// Delayed case
					// Write delayed CNI config file
					data, err := os.ReadFile(filepath.Join("testdata", c.delayedConfName))
					if err != nil {

            {{- toYaml . | nindent 10 }}
          {{- end }}
      volumes:
      # Technically not needed on this pod - but it helps debugging/testing SDS
      # Should be removed after everything works.
      - emptyDir:
          medium: Memory
        name: local-certs
      - name: istio-token
        projected:
          sources:
            - serviceAccountToken:

		time.Sleep(time.Duration(msInterval) * time.Millisecond)
	}

	if ambientPod == nil {
		return fmt.Errorf("got event for pod %s in namespace %s but could not find in pod cache after retries", addCmd.PodName, addCmd.PodNamespace)
	}
	log.Debugf("Pod: %s in ns: %s is enabled for ambient, adding to mesh.", addCmd.PodName, addCmd.PodNamespace)

	var podIps []netip.Addr