}

		for _, cmd := range optionalDeleteCmds {
			err := cfg.ext.Run(iptablesconstants.IPTables, &iptVer, nil, cmd...)
			if err != nil {
				log.Debugf("ignoring error deleting optional iptables rule: %v", err)
			}
		}
	}
	return errors.Join(delErrs...)
}

// Setup iptables rules for in-pod mode. Ideally this should be an idempotent function.

	client := kube.NewFakeClient(ns, pod)

	// We are expecting at most 1 calls to the mock, wait for them
	wg, waitForMockCalls := NewWaitForNCalls(t, 1)
	fs := &fakeServer{testWG: wg}

	fs.On("AddPodToMesh",
		ctx,
		pod,
		util.GetPodIPsIfPresent(pod),
		"",
	).Return(nil)

	server := &meshDataplane{
		kubeClient: client.Kube(),
		netServer:  fs,
	}

	"istio.io/istio/istioctl/pkg/cli"
	"istio.io/istio/pkg/kube"
)

func getPodsNameInDefaultNamespace(ctx cli.Context, toComplete string) ([]string, error) {
	client, err := ctx.CLIClient()
	if err != nil {
		return nil, err
	}
	ns := ctx.NamespaceOrDefault(ctx.Namespace())
	podList, err := client.Kube().CoreV1().Pods(ns).List(context.Background(), metav1.ListOptions{})
	if err != nil {

  - name: istiod-ca-cert
    configMap:
      name: istio-ca-root-cert
  {{- end }}
  {{- if eq .Values.global.pilotCertProvider "kubernetes" }}
  - name: kube-ca-cert
    configMap:
      name: kube-root-ca.crt
  {{- end }}
  {{- if .Values.global.mountMtlsCerts }}
  # Use the key and cert mounted to /etc/certs/ for the in-cluster mTLS communications.
  - name: istio-certs
    secret:

  - name: istiod-ca-cert
    configMap:
      name: istio-ca-root-cert
  {{- end }}
  {{- if eq .Values.global.pilotCertProvider "kubernetes" }}
  - name: kube-ca-cert
    configMap:
      name: kube-root-ca.crt
  {{- end }}
  {{- if .Values.global.mountMtlsCerts }}
  # Use the key and cert mounted to /etc/certs/ for the in-cluster mTLS communications.
  - name: istio-certs
    secret:

		t.Fatal(err)
	}

	if diff := util.YAMLDiff(wantYAML, gotYAML); diff != "" {
		t.Fatalf("diff: %s", diff)
	}
}

func MockKubernetesClients(_ kube.CLIClient, _ clog.Logger) (kube.CLIClient, client.Client, error) {
	extendedClient = kube.NewFakeClient()
	kubeClient, _ = client.New(&rest.Config{}, client.Options{})
	return extendedClient, kubeClient, nil
}

func TestOperatorInitDryRun(t *testing.T) {

          istio:
            workload: istiod;istio-system;;;Kubernetes
    loadBalancingWeight: 1
    locality: {}
  policy:
    overprovisioningFactor: 140
- clusterName: outbound|53||kube-dns.kube-system.svc.cluster.local
  endpoints:
  - lbEndpoints:
    - endpoint:
        address:
          socketAddress:
            address: 10.244.0.8
            portValue: 53
        healthCheckConfig: {}

```console
helm install istio-cni istio/cni -n kube-system
```

Installation in `kube-system` is recommended to ensure the [`system-node-critical`](https://kubernetes.io/docs/tasks/administer-cluster/guaranteed-scheduling-critical-addon-pods/)
`priorityClassName` can be used. You can install in other namespace only on K8S clusters that allow
'system-node-critical' outside of kube-system.

## Configuration

	"istio.io/api/label"
	"istio.io/istio/pkg/config/constants"
	"istio.io/istio/pkg/kube"
)

func IsZtunnelPod(client kube.CLIClient, podName, podNamespace string) bool {
	isZtunnel := strings.HasPrefix(podName, "ztunnel")
	if client == nil {
		return isZtunnel
	}
	pod, err := client.Kube().CoreV1().Pods(podNamespace).Get(context.Background(), podName, metav1.GetOptions{})
	if err != nil {
		return isZtunnel

	"istio.io/istio/operator/pkg/translate"
	operatorutil "istio.io/istio/operator/pkg/util"
	"istio.io/istio/operator/pkg/util/clog"
	"istio.io/istio/pkg/config/constants"
	"istio.io/istio/pkg/config/labels"
	"istio.io/istio/pkg/kube"
	buildversion "istio.io/istio/pkg/version"
)

type operatorInitArgs struct {
	// inFilenames is the path to the input IstioOperator CR.
	inFilename string

	// common is shared operator args