{
               "tag": "istio.authorization.dry_run.allow_policy.name",
               "metadata": {
                "kind": {
                 "request": {}
                },
                "metadata_key": {
                 "key": "envoy.filters.http.rbac",
                 "path": [
                  {
                   "key": "istio_dry_run_allow_shadow_effective_policy_id"
                  }

	// ErrInvalidField invalid field
	ErrInvalidField = errors.New("invalid field")
	// ErrEmptySlice empty slice found
	ErrEmptySlice = errors.New("empty slice found")
	// ErrDryRunModeUnsupported dry run mode unsupported
	ErrDryRunModeUnsupported = errors.New("dry run mode unsupported")
	// ErrInvalidDB invalid db
	ErrInvalidDB = errors.New("invalid db")
	// ErrInvalidValue invalid value

                                      "key": "istio_dry_run_allow_shadow_effective_policy_id"
                                    }
                                  ]
                                }
                              }
                            },
                            {
                              "tag": "istio.authorization.dry_run.allow_policy.result",
                              "metadata": {

  kubectl create configmap -n istio-system istio-grafana-dashboards \
    --dry-run=client -oyaml \
    --from-file=pilot-dashboard.json="${TMP}/pilot-dashboard.json" \
    --from-file=istio-performance-dashboard.json="${TMP}/istio-performance-dashboard.json"

  echo -e "\n---\n"
  kubectl create configmap -n istio-system istio-services-grafana-dashboards \
    --dry-run=client -oyaml \

  namespace: {{ .Values.global.istioNamespace }}
  labels:
    app: istiod
    release: {{ .Release.Name }}
rules:
# permissions to verify the webhook is ready and rejecting
# invalid config. We use --server-dry-run so no config is persisted.
- apiGroups: ["networking.istio.io"]
  verbs: ["create"]
  resources: ["gateways"]

# For storing CA secret
- apiGroups: [""]
  resources: ["secrets"]

	"istio.io/istio/istioctl/pkg/cli"
	"istio.io/istio/pkg/kube"
	"istio.io/istio/pkg/test/env"
)

func TestProfileList(t *testing.T) {
	g := NewWithT(t)
	args := []string{"profile", "list", "--dry-run", "--manifests", filepath.Join(env.IstioSrc, "manifests")}

	kubeClientFunc = func() (kube.CLIClient, error) {
		return nil, nil
	}
	rootCmd := GetRootCmd(cli.NewFakeContext(&cli.NewFakeContextOption{
		Version: "25",

  namespace: {{ .Values.global.istioNamespace }}
  labels:
    app: istiod
    release: {{ .Release.Name }}
rules:
# permissions to verify the webhook is ready and rejecting
# invalid config. We use --server-dry-run so no config is persisted.
- apiGroups: ["networking.istio.io"]
  verbs: ["create"]
  resources: ["gateways"]

# For storing CA secret
- apiGroups: [""]
  resources: ["secrets"]

                                      "key": "istio_dry_run_allow_shadow_effective_policy_id"
                                    }
                                  ]
                                }
                              }
                            },
                            {
                              "tag": "istio.authorization.dry_run.allow_policy.result",
                              "metadata": {

                                      "key": "istio_dry_run_allow_shadow_effective_policy_id"
                                    }
                                  ]
                                }
                              }
                            },
                            {
                              "tag": "istio.authorization.dry_run.allow_policy.result",
                              "metadata": {

			watchedNamespaces: "test4, test5",
		},
	}

	kubeClients = MockKubernetesClients

	for _, test := range tests {
		t.Run("", func(t *testing.T) {
			args := []string{"operator", "init", "--dry-run"}
			if test.operatorNamespace != "" {
				args = append(args, "--operatorNamespace", test.operatorNamespace)
			}
			if test.watchedNamespaces != "" {