// for the pod. If this is a pod added via informer, the pod should have already gone thru
			// the CNI plugin chain, and have a PodIP.
			//
			// If PodIPs exists, it is preferred, otherwise fallback to PodIP.
			//
			// If we get to this point and have a pod that really and truly has no IP in either of those,

	// and kubelet (skippable) traffic would have the same srcip once they got to the pod, and would be indistinguishable.
	//
	// Note that SortedList is used here because the istio sets class has no order guarantees,
	// and our unit tests will flake if rules have a nondeterministic ordering.
	// CLI: -t mangle -A ISTIO_PRERT -s 169.254.7.127 -p tcp -m tcp --dport <PROBEPORT> -j ACCEPT

	uid := fixture.uid

	m, fds := readRequest(t, ztunClient)
	// we got am essage from ztun, so it should have observed us being connected
	mt.Assert(ztunnelConnected.Name(), nil, monitortest.Exactly(1))

	// we should get the fd to dev null. note that we can't assert the fd number
	// as the kernel may have given us a different number that refers to the same file.
	assert.Equal(t, len(fds), 1)

				return nil
			}
		}
	}

	return fmt.Errorf("no files, or unrecognized op")
}

// checkTempFilesCleaned verifies that all temporary files have been cleaned up
func checkTempFilesCleaned(tempCNIConfDir string, t *testing.T) {
	t.Helper()
	files, err := os.ReadDir(tempCNIConfDir)
	if err != nil {
		t.Fatalf("Failed to list files, err: %v", err)
	}

// the kernel can be out of sync with the CLI utility, leading to errors like:
//
// ipset v7.10: Argument `comment' is supported in the kernel module of the set type hash:ip
// starting from the revision 3 and you have installed revision 1 only.
// Your kernel is behind your ipset utility.
//
// This happens with kernels as recent as Fedora38, e.g: 6.4.11-200.fc38.aarch64
func (m *realDeps) clearEntriesWithComment(name, comment string) error {

	clusterDump, err := w.GetClusterConfigDump()
	if err != nil {
		return nil, err
	}
	dac := clusterDump.GetDynamicActiveClusters()
	// Allow sorting to work even if we don't have the exact same type
	for i := range dac {
		dac[i].Cluster.TypeUrl = v3.ClusterType
	}
	sort.Slice(dac, func(i, j int) bool {
		cluster := &cluster.Cluster{}
		err = dac[i].Cluster.UnmarshalTo(cluster)

		}
		tag, exists := wh.ObjectMeta.Labels[IstioTagLabel]
		if !exists {
			t.Errorf("expected tag webhook to have %s label, did not find", IstioTagLabel)
		}
		if tag != tc.tagName {
			t.Errorf("expected tag webhook to have istio.io/tag=%s, found %s instead", tc.tagName, tag)
		}

		// ensure all webhooks have the correct client config
		for _, webhook := range wh.Webhooks {
			injectionWhConf := webhook.ClientConfig

		err = drc[j].RouteConfig.UnmarshalTo(r)
		if err != nil {
			return false
		}
		return name < r.Name
	})

	// In Istio 1.5, it is not enough just to sort the routes.  The virtual hosts
	// within a route might have a different order.  Sort those too.
	for i := range drc {
		route := &route.RouteConfiguration{}
		err = drc[i].RouteConfig.UnmarshalTo(route)
		if err != nil {
			return nil, err
		}

			meshConfigMapName, ctx.IstioNamespace(), err)
	}
	// values in the data are strings, while proto might use a
	// different data type.  therefore, we have to get a value by a
	// key
	configYaml, exists := meshConfigMap.Data[configMapKey]
	if !exists {
		return nil, fmt.Errorf("missing configuration map key %q", configMapKey)
	}

			if rootCA1 == rootCA2 {
				report := fmt.Sprintf("Both [%s.%s] and [%s.%s] have the identical ROOTCA, theoretically the connectivity between them is available",
					podName1, podNamespace1, podName2, podNamespace2)
				c.Println(report)
				returnErr = nil
			} else {
				report := fmt.Sprintf("Both [%s.%s] and [%s.%s] have the non identical ROOTCA, theoretically the connectivity between them is unavailable",