return f.full.UnstructuredClientForMapping(mapping)
}

func (f Factory) Validator(validationDirective string) (validation.Schema, error) {
	return f.full.Validator(validationDirective)
}

func (f Factory) OpenAPISchema() (openapi.Resources, error) {
	return f.full.OpenAPISchema()
}

func (f Factory) OpenAPIV3Client() (openapiclient.Client, error) {
	return f.full.OpenAPIV3Client()
}

var _ util.Factory = Factory{}

	"sigs.k8s.io/yaml"

	"istio.io/istio/cni/pkg/config"
	"istio.io/istio/cni/pkg/constants"
	"istio.io/istio/pilot/pkg/model"
	"istio.io/istio/pkg/file"
)

type kubeconfig struct {
	// The full kubeconfig
	Full string
	// Kubeconfig with confidential data redacted.
	Redacted string
}

func createKubeConfig(cfg *config.InstallConfig) (kubeconfig, error) {
	if len(cfg.K8sServiceHost) == 0 {

{{- else if .Values.cni.repair.deletePods }}
  - apiGroups: [""]
    resources: ["pods"]
    verbs: ["delete"]
{{- else if .Values.cni.repair.labelPods }}
  - apiGroups: [""]
    {{- /* pods/status is less privileged than the full pod, and either can label. So use the lower pods/status */}}
    resources: ["pods/status"]
    verbs: ["patch", "update"]
{{- end }}
{{- end }}
---
{{- if .Values.cni.ambient.enabled }}

		Long:  `Retrieve information about certificates for the Ztunnel instance.`,
		Example: `  # Retrieve summary about workload configuration for a randomly chosen ztunnel.
  istioctl x ztunnel-config certificates

  # Retrieve full certificate dump of workloads for a given Ztunnel instance.
  istioctl x ztunnel-config certificates <ztunnel-name[.namespace]> -o json
`,
		Aliases: []string{"certificates", "certs", "cert"},
		Args:    common.validateArgs,

		Example: `  # Retrieve summary about all configuration for a given pod from Envoy.
  istioctl proxy-config all <pod-name[.namespace]>

  # Retrieve full cluster dump as JSON
  istioctl proxy-config all <pod-name[.namespace]> -o json

  # Retrieve full cluster dump with short syntax
  istioctl pc a <pod-name[.namespace]>

  # Retrieve cluster summary without using Kubernetes API

    # it's a comma-separated list of prefixes
    local-prefixes: istio.io/
issues:
  # Which dirs to exclude: issues from them won't be reported.
  # Can use regexp here: `generated.*`, regexp is applied on full path,
  # including the path prefix if one is set.
  # Default dirs are skipped independently of this option's value (see exclude-dirs-use-default).

				t.Fatalf("expected failure")
			}

			goldenFilepath := "testdata/kubeconfig-tls"
			if c.skipTLSVerify {
				goldenFilepath = "testdata/kubeconfig-skip-tls"
			}

			testutils.CompareContent(t, []byte(result.Full), goldenFilepath)
		})
	}
}

func TestReplaceInvalidKubeconfigFile(t *testing.T) {
	tmp := t.TempDir()
	os.WriteFile(filepath.Join(tmp, "token"), []byte(saToken), 0o644)
	constants.ServiceAccountPath = tmp

		},
		{
			description: "valid case - create full workload group",
			args: strings.Split("group create --name foo --namespace bar --labels app=foo,bar=baz "+
				" --annotations annotation=foobar --ports grpc=3550,http=8080 --serviceAccount test", " "),
			expectedException: false,
			expectedOutput:    customYAML,
		},
		{
			description: "valid case - create full workload group with shortnames",

  exclude:
    - composite literal uses unkeyed fields
  # Which dirs to exclude: issues from them won't be reported.
  # Can use regexp here: `generated.*`, regexp is applied on full path,
  # including the path prefix if one is set.
  # Default dirs are skipped independently of this option's value (see exclude-dirs-use-default).

fi

# Gets the download command supported by the system (currently either curl or wget)
DOWNLOAD_COMMAND=""
function set_download_command () {
  # Try curl.
  if command -v curl > /dev/null; then
    if curl --version | grep Protocols  | grep https > /dev/null; then
      DOWNLOAD_COMMAND="curl -fLSs --retry 5 --retry-delay 1 --retry-connrefused"
      return
    fi
    echo curl does not support https, will try wget for downloading files.
  else