}

		ecds = append(ecds, c)
	}

	sort.Slice(ecds, func(i, j int) bool {
		if ecds[i].GetTypedConfig().GetTypeUrl() == ecds[j].GetTypedConfig().GetTypeUrl() {
			return ecds[i].GetName() < ecds[j].GetName()
		}

		return ecds[i].GetTypedConfig().GetTypeUrl() < ecds[j].GetTypedConfig().GetTypeUrl()
	})

	return ecds, nil

						"This is not recommended, See "+url.ProtocolSelection, fmt.Sprintf("%s/%s/:", un.GetName(), un.GetNamespace())))
				}
			} else {
				if p["name"] == nil {
					errs = multierror.Append(errs, fmt.Errorf("service %q has an unnamed port. This is not recommended,"+
						" See "+url.DeploymentRequirements, fmt.Sprintf("%s/%s/:", un.GetName(), un.GetNamespace())))
					continue
				}
				if servicePortPrefixed(p["name"].(string)) {

				case wellknown.HTTPConnectionManager, "envoy.http_connection_manager":
					if cm := getHTTPConnectionManager(filter); cm != nil {
						for _, httpFilter := range cm.GetHttpFilters() {
							switch httpFilter.GetName() {
							case wellknown.HTTPRoleBasedAccessControl:
								rbacHTTP := &rbachttp.RBAC{}
								if err := getHTTPFilterConfig(httpFilter, rbacHTTP); err != nil {

// TODO it is sort of pointless/confusing/implicit to populate Old and New with the same reference here
func (s *InformerHandlers) enqueueNamespace(o controllers.Object) {
	namespace := o.GetName()
	labels := o.GetLabels()
	matchAmbient := labels[constants.DataplaneMode] == constants.DataplaneModeAmbient
	if matchAmbient {
		log.Infof("Namespace %s is enabled in ambient mesh", namespace)
	} else {

		if err != nil {
			return err
		}
		for w := range watch.ResultChan() {
			o, ok := w.Object.(metav1.Object)
			if !ok {
				continue
			}
			if o.GetName() == nf {
				result <- strconv.FormatInt(o.GetGeneration(), 10)
			}
			select {
			case <-ictx.Done():
				return ictx.Err()
			default:
				continue
			}
		}

		return nil
	})

	case *matcher.Matcher_OnMatch_Action:
		if v.Action.GetName() == fc.GetName() {
			return []string{"UNMATCHED"}
		}
	case *matcher.Matcher_OnMatch_Matcher:
		ms, f := recurse(fc.GetName(), v.Matcher)
		if !f {
			return []string{"NONE"}
		}
		return ms
	}
	ms, f := recurse(fc.GetName(), l.GetFilterChainMatcher())
	if !f {
		return []string{"NONE"}
	}
	return ms
}

	switch cs := vhRoute.GetRoute().GetClusterSpecifier().(type) {
	case *route.RouteAction_Cluster:
		clusterName = cs.Cluster
	case *route.RouteAction_WeightedClusters:
		clusterName = cs.WeightedClusters.Clusters[0].GetName()
	}

	// If this is an ingress gateway, the Domains will be something like *:80, so check routes
	// which will look like "outbound|9080||productpage.default.svc.cluster.local"

	}
	return w.Flush()
}

func configSource(flag string, v env.VariableInfo) string {
	// Environment variables have high precedence in Viper
	if v.IsSet() {
		return "$" + v.GetName()
	}

	if viper.InConfig(flag) {
		return root.IstioConfig
	}

	return "default"

					Type: config.GroupVersionKind(deployment.GroupVersionKind()),
					FullName: resource.FullName{
						Namespace: resource.Namespace(deployment.GetNamespace()),
						Name:      resource.LocalName(deployment.GetName()),
					},
					ResourceVersion: resource.Version(deployment.GetResourceVersion()),
					Ref:             nil,
					FieldsMap:       nil,
				},
			}
			messages.Add(msg.NewUpdateIncompatibility(res,