outputFormat: "json",
			filter:       EndpointFilter{},
		},
		{
			name:         "emptyfilter",
			outputFormat: "yaml",
			filter:       EndpointFilter{},
		},
		{
			name:         "portfilter",
			outputFormat: "json",
			filter: EndpointFilter{
				Port: 8080,
			},
		},
		{
			name:         "portfilter",
			outputFormat: "yaml",
			filter: EndpointFilter{
				Port: 8080,
			},
		},
	}

}

// PrintServiceSummary prints a summary of the relevant services in the config dump to the ConfigWriter stdout
func (c *ConfigWriter) PrintPolicySummary(filter PolicyFilter) error {
	w := c.tabwriter()
	zDump := c.ztunnelDump

	pols := slices.Filter(maps.Values(zDump.Policies), filter.Verify)
	slices.SortFunc(pols, func(a, b *ZtunnelPolicy) int {
		if r := cmp.Compare(a.Namespace, b.Namespace); r != 0 {
			return r
		}

istio.io/telemetry/stats/prometheus/sidecar/Outbound/TCP      
default.display-metadata                                      envoy.extensions.filters.http.wasm.v3.Wasm

	cmd.PersistentFlags().StringSliceVar(&args.Components, "component", nil, ComponentFlagHelpStr)
	cmd.PersistentFlags().StringSliceVar(&args.Filter, "filter", nil, "")
	_ = cmd.PersistentFlags().MarkHidden("filter")

	cmd.PersistentFlags().BoolVar(&args.EnableClusterSpecific, "cluster-specific", false,
		"If enabled, the current cluster will be checked for cluster-specific setting detection.")
}

active loggers:
  admin: warning
  aws: warning
  assert: warning
  backtrace: warning
  client: warning
  config: warning
  connection: warning
  dubbo: warning
  file: warning
  filter: warning
  forward_proxy: warning
  grpc: warning
  hc: warning
  health_checker: warning
  http: warning
  http2: warning
  hystrix: warning
  init: warning
  io: warning
  jwt: warning
  kafka: warning
  lua: warning

  // `example.com:foo:v1`.
  //
  // If signerName is empty, then the ClusterTrustBundle object's name must
  // not have such a prefix.
  //
  // List/watch requests for ClusterTrustBundles can filter on this field
  // using a `spec.signerName=NAME` field selector.
  //
  // +optional
  optional string signerName = 1;

  // trustBundle contains the individual X.509 trust anchors for this

// capacity-aware scheduling with CSIDriverSpec.StorageCapacity. The scheduler
// compares the MaximumVolumeSize against the requested size of pending volumes
// to filter out unsuitable nodes. If MaximumVolumeSize is unset, it falls back
// to a comparison against the less precise Capacity. If that is also unset,
// the scheduler assumes that capacity is insufficient and tries some other
// node.

  // +optional
  map<string, k8s.io.apimachinery.pkg.api.resource.Quantity> hard = 1;

  // A collection of filters that must match each object tracked by a quota.
  // If not specified, the quota matches all objects.
  // +optional
  repeated string scopes = 2;

  // scopeSelector is also a collection of filters like scopes that must match each object tracked by a quota

{
    "configs": [
        {
            "@type": "type.googleapis.com/envoy.admin.v3.EcdsConfigDump",
            "ecds_filters": [
                {
                    "version_info": "2022-12-08T09:07:09Z/10",
                    "ecds_filter": {
                        "@type": "type.googleapis.com/envoy.config.core.v3.TypedExtensionConfig",
                        "name": "default.httpbin-rate-limiting",
                        "typed_config": {

	if err != nil {
		return []corev1.Namespace{}, err
	}
	filtered := filterSystemNamespaces(nslist.Items, istioNamespace)
	filtered = slices.Filter(filtered, func(namespace corev1.Namespace) bool {
		return !ambient.InAmbient(&namespace)
	})
	sort.Slice(filtered, func(i, j int) bool {
		return filtered[i].Name < filtered[j].Name
	})
	return filtered, nil
}