return cniConfigFilepath, err
	}

	if cfg.chainedCNIPlugin && strings.HasSuffix(cniConfigFilepath, ".conf") {
		// If the old CNI config filename ends with .conf, rename it to .conflist, because it has to be changed to a list
		installLog.Infof("Renaming %s extension to .conflist", cniConfigFilepath)
		err = os.Rename(cniConfigFilepath, cniConfigFilepath+"list")
		if err != nil {

watchedNamespaces: {{.WatchedNamespaces}}
hub: {{.Hub}}
tag: {{.Tag}}
{{- if .ImagePullSecrets }}
imagePullSecrets:
{{- range .ImagePullSecrets }}
- {{ . }}
{{- end }}
{{- end }}
revision: {{if .Revision }} {{.Revision}} {{else}} "" {{end}}
`

	tv := struct {
		IstioNamespace    string
		WatchedNamespaces string
		Hub               string
		Tag               string
		ImagePullSecrets  []string

		return err
	}
	defer netNs.Close()

	return netNs.Do(func(_ ns.NetNS) error {
		log.Infof("============= Start iptables configuration for %v =============", podName)
		defer log.Infof("============= End iptables configuration for %v =============", podName)
		return cmd.ProgramIptables(cfg)
	})

		}
		responses = append(responses, response)
		if !all && len(responses) > 0 {
			break
		}
	}
	return responses, nil
}

// queryDebugSynczViaAgents sends a debug/syncz xDS request via Istio Agents.
// By this way, even if istioctl cannot access a specific `istiod` instance directly,
// `istioctl` can access the debug endpoint.

	cw := &ConfigWriter{Stdout: gotOut}
	cd, _ := os.ReadFile("testdata/ecds/configdump.json")
	cw.Prime(cd)
	err := cw.PrintEcdsSummary()
	assert.NoError(t, err)

	util.CompareContent(t, gotOut.Bytes(), "testdata/ecds/output.txt")
}

func TestPrintEcdsYaml(t *testing.T) {
	gotOut := &bytes.Buffer{}
	cw := &ConfigWriter{Stdout: gotOut}
	cd, _ := os.ReadFile("testdata/ecds/configdump.json")
	cw.Prime(cd)
	err := cw.PrintEcds("yaml")

			if err != nil {
				return nil, nil, fmt.Errorf("could not parse node metadata: %w", err)
			}
			if s.Namespace != "" && meta.Namespace != s.Namespace {
				continue
			}
			cds, lds, eds, rds, ecds := getSyncStatus(&clientConfig)
			cp := multixds.CpInfo(dr)
			fullStatus = append(fullStatus, &xdsWriterStatus{
				proxyID:               clientConfig.GetNode().GetId(),
				clusterID:             meta.ClusterID.String(),

			return ecds[i].GetName() < ecds[j].GetName()
		}

		return ecds[i].GetTypedConfig().GetTypeUrl() < ecds[j].GetTypedConfig().GetTypeUrl()
	})

	return ecds, nil

}

var (
	loggerLevelString = ""
	reset             = false
)

func extractConfigDump(kubeClient kube.CLIClient, podName, podNamespace string, eds bool) ([]byte, error) {
	path := "config_dump"
	if eds {
		path += "?include_eds=true"
	}
	debug, err := kubeClient.EnvoyDoWithPort(context.TODO(), podName, podNamespace, "GET", path, proxyAdminPort)
	if err != nil {

			wantException:  true,
		},
		{ // case 1, with Istiod instance
			args:           []string{},
			expectedString: "NAME     CLUSTER     CDS     LDS     EDS     RDS     ECDS     ISTIOD",
		},
		{ // case 2: supplying nonexistent pod name should result in error with flag
			args:          strings.Split("deployment/random-gibberish", " "),
			wantException: true,
		},

	routes    configTypeURL = "type.googleapis.com/envoy.admin.v3.RoutesConfigDump"
	secrets   configTypeURL = "type.googleapis.com/envoy.admin.v3.SecretsConfigDump"
	ecds      configTypeURL = "type.googleapis.com/envoy.admin.v3.EcdsConfigDump"
)

// getSection takes a TypeURL and returns the types.Any from the config dump corresponding to that URL