}
			continue
		}
		if checkGolden {
			t.Run(f.Name(), func(t *testing.T) {
				contents := util.ReadFile(t, path.Join(testdir, f.Name()))
				goldenFile := path.Join(testdir, f.Name()+goldenSuffix)
				util.RefreshGoldenFile(t, contents, goldenFile)
				util.CompareContent(t, contents, goldenFile)
			})
		}
	}
}

func TestConvertToMap(t *testing.T) {
	tests := []struct {

func applyWithReconciler(reconciler *helmreconciler.HelmReconciler, manifest string) error {
	m := name.Manifest{
		// Name is not important here, only Content will be applied.
		Name:    name.IstioOperatorComponentName,
		Content: manifest,
	}
	_, err := reconciler.ApplyManifest(m)
	return err
}

	// redetect for each pod anyway.
	//
	// Extreme corner case:
	// If for some reason your host had both binaries, and you were injecting out-of-band
	// iptables rules within a pod context into `legacy` tables, but your host context preferred
	// `nft`, we would still inject our rules in-pod into nft tables, which is a bit wonky.
	//
	// But that's stunningly unlikely (and would still work either way)

		t.Run(c.name, func(t *testing.T) {
			srcDir := t.TempDir()
			for filename, contents := range c.srcFiles {
				file.WriteOrFail(t, filepath.Join(srcDir, filename), []byte(contents))
			}

			targetDir := t.TempDir()
			for filename, contents := range c.existingFiles {
				file.WriteOrFail(t, filepath.Join(targetDir, filename), []byte(contents))
			}

			binariesCopied, err := copyBinaries(srcDir, []string{targetDir})

			gateways: []*gateway.Gateway{
				makeGateway(constants.DefaultNamespaceWaypoint, "default", true, true),
				makeGateway(constants.DefaultNamespaceWaypoint, "fake", true, true),
			},
			expectedOutFile: "default-gateway",
		},
		{
			name: "all namespaces gateways",
			args: strings.Split("list -A", " "),
			gateways: []*gateway.Gateway{
				makeGateway(constants.DefaultNamespaceWaypoint, "default", true, true),

			UID:       types.UID("test"),
			Annotations: map[string]string{
				constants.AmbientRedirection: constants.AmbientRedirectionEnabled,
			},
		},
	}
}

type fakeServer struct {
	mock.Mock
	testWG *WaitGroup // optional waitgroup, if code under test makes a number of async calls to fakeServer
}

func (f *fakeServer) AddPodToMesh(ctx context.Context, pod *corev1.Pod, podIPs []netip.Addr, netNs string) error {

		}
		namespace = t.Namespace
		selector, err = labels.Parse(constants.GatewayNameLabel + "=" + t.Name)
	case *gatewayapibeta.Gateway:
		if !gateway.IsManaged(&t.Spec) {
			return "", nil, fmt.Errorf("gateway is not a managed gateway")
		}
		namespace = t.Namespace
		selector, err = labels.Parse(constants.GatewayNameLabel + "=" + t.Name)
	default:
		return polymorphichelpers.SelectorsForObject(object)

// limitations under the License.

package log

import (
	"io"
	"os"
	"path/filepath"
	"strings"
	"testing"

	"istio.io/istio/cni/pkg/constants"
	"istio.io/istio/pkg/log"
	"istio.io/istio/pkg/test/util/assert"
)

func TestUDSLog(t *testing.T) {
	// Start UDS log server
	udsSockDir := t.TempDir()
	udsSock := filepath.Join(udsSockDir, "cni.sock")

// * /var/lib/cni/results shows the outputs of CNI plugins; this containers the bind-mounted network namespace file.
//
// Instead, we traverse the procfs. Comments on this method are inline.
func getPodNetNs(pod *corev1.Pod) (string, error) {
	// First, find the network namespace id by looking the interface with the given Pod IP.

	ConstructInitialSnapshot(ambientPods []*corev1.Pod) error
	Start(ctx context.Context)

	//	IsPodInMesh(ctx context.Context, pod *metav1.ObjectMeta, netNs string) (bool, error)
	AddPodToMesh(ctx context.Context, pod *corev1.Pod, podIPs []netip.Addr, netNs string) error
	RemovePodFromMesh(ctx context.Context, pod *corev1.Pod) error
	DelPodFromMesh(ctx context.Context, pod *corev1.Pod) error

	Stop()
}

type Server struct {