log.Debug("debug log")
	log.Info("info log")
	log.Warn("warn log")
	log.Error("error log")
	// This will error because stdout cannot sync, but the UDS part should sync
	// Ideally we would fail if the UDS part fails but the error library makes it kind of tricky
	_ = log.Sync()

	// Restore os stdout.
	os.Stdout = stdout
	assert.NoError(t, log.Configure(loggingOptions))

	assert.NoError(t, w.Close())

		},
		{ // supplying valid pod name retrieves Envoy config (fails because we don't check in Envoy config unit tests)
			execClientConfig: loggingConfig,
			args:             strings.Split("bootstrap httpbin-794b576b6c-qx6pf", " "),
			expectedString:   `config dump has no configuration type`,
			wantException:    true,
		},
		{ // supplying valid pod name retrieves Envoy config (fails because we don't check in Envoy config unit tests)

    - it also sets up a UDS socket for istio-cni to send logs to this container.
    - based on config, it may run the 'repair' controller that detects pods where istio setup fails and restarts them, or created in corner cases.
    - if ambient is enabled, also runs an ambient controller, watching Pod, Namespace

- `istio-cni`
    - CNI plugin executable copied to `/opt/cni/bin`

	ctx context.Context,
	clnt client.WithWatch,
	obj client.Object,
	patch client.Patch,
	opts ...client.PatchOption,
) error {
	// Apply patches are supposed to upsert, but fake client fails if the object doesn't exist,
	// if an apply patch occurs for an object that doesn't yet exist, create it.
	if patch.Type() != types.ApplyPatchType {
		return clnt.Patch(ctx, obj, patch, opts...)
	}

  // +optional
  optional bool suspend = 10;
}

// JobStatus represents the current state of a Job.
message JobStatus {
  // The latest available observations of an object's current state. When a Job
  // fails, one of the conditions will have type "Failed" and status true. When
  // a Job is suspended, one of the conditions will have type "Suspended" and
  // status true; when the Job is resumed, the status of this condition will

  // pod is immediatedly created on that node without considering surge limits.
  // Allowing surge implies the possibility that the resources consumed by the
  // daemonset on any given node can double if the readiness check fails, and
  // so resource intensive daemonsets should take into account that they may
  // cause evictions during disruption.
  // +optional
  optional k8s.io.apimachinery.pkg.util.intstr.IntOrString maxSurge = 2;
}

  // Container will be restarted if the probe fails.
  // Cannot be updated.
  // More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes
  // +optional
  optional Probe livenessProbe = 10;

  // Periodic probe of container service readiness.
  // Container will be removed from service endpoints if the probe fails.
  // Cannot be updated.

      path: "{{ .injectionPath }}"
      port: 443
    {{- end }}
  sideEffects: None
  rules:
  - operations: [ "CREATE" ]
    apiGroups: [""]
    apiVersions: ["v1"]
    resources: ["pods"]
  failurePolicy: Fail
  admissionReviewVersions: ["v1beta1", "v1"]
{{- end }}
{{- range $tagName := $.Values.revisionTags }}
apiVersion: admissionregistration.k8s.io/v1
kind: MutatingWebhookConfiguration
metadata:

{{- $res := tpl (print "{{" (repeat (split "." $dep | len) "(")  ".Values." (replace "." ")." $dep) ")}}") $}}
{{- if not (eq $res "")}}
{{fail (print $dep " is removed")}}
{{- end }}

			expectedString: "Error: expecting pod name",
			wantException:  true, // "istioctl experimental inspect pod" should fail
		},
		{ // case 3 unknown pod
			args:           strings.Split("po not-a-pod", " "),
			expectedString: "pods \"not-a-pod\" not found",
			wantException:  true, // "istioctl experimental describe pod not-a-pod" should fail
		},
		{ // case 8 unknown service
			args:           strings.Split("service not-a-service", " "),