b, err := yaml.Marshal(gw)
			if err != nil {
				return err
			}
			_, err = gwc.Patch(context.Background(), gw.Name, types.ApplyPatchType, b, metav1.PatchOptions{
				Force:        nil,
				FieldManager: "istioctl",
			})
			if err != nil {
				if errors.IsNotFound(err) {
					return fmt.Errorf("missing Kubernetes Gateway CRDs need to be installed before applying a waypoint: %s", err)

	// SkipConfirmation determines whether the user is prompted for confirmation.
	// If set to true, the user is not prompted and a Yes response is assumed in all cases.
	SkipConfirmation bool
	// Force proceeds even if there are validation errors
	Force bool
	// Verify after installation
	Verify bool
	// Set is a string with element format "path=value" where path is an IstioOperator path and the value is a
	// value to set the node at that path to.

However, while we chose to use the xDS *transport protocol*, we chose to not use the xDS resource types, such as Clusters and Listeners.
In our experience and testing, these types force us to represent data in inefficient ways because they are general purpose.
Ztunnel is not general purpose; it has an extremely tight goal.

	testResourceFile := "duplicate_mwc"

	testCases := []struct {
		name       string
		force      bool
		assertFunc func(g *WithT, objs *ObjectSet, err error)
	}{
		{
			name:  "Duplicate MutatingWebhookConfiguration should be allowed when --force is enabled",
			force: true,
			assertFunc: func(g *WithT, objs *ObjectSet, err error) {
				g.Expect(err).Should(BeNil())

  // rule is the strategy that will dictate what FSGroup is used in the SecurityContext.
  // +optional
  optional string rule = 1;

  // ranges are the allowed ranges of fs groups.  If you would like to force a single
  // fs group then supply a single range with the same start and end. Required for MustRunAs.
  // +optional
  repeated IDRange ranges = 2;
}