def normalize(rl, args):
    for i in range(len(rl)):
        rl[i] = normalize_res(rl[i], args)

    return rl


def compare(args):
    j0 = normalize(list(yaml.safe_load_all(open(args.orig))), args)
    j1 = normalize(list(yaml.safe_load_all(open(args.new))), args)

    q0 = {by_resource_name(res): res for res in j0 if res is not None}
    q1 = {by_resource_name(res): res for res in j1 if res is not None}

)

// ConfigWriter is a writer for processing responses from the Ztunnel Admin config_dump endpoint
type ConfigWriter struct {
	Stdout      io.Writer
	ztunnelDump *ZtunnelDump
	FullDump    []byte
}

// Prime loads the config dump into the writer ready for printing
func (c *ConfigWriter) Prime(b []byte) error {
	cd := ZtunnelDump{}
	// TODO(fisherxu): migrate this to jsonpb when issue fixed in golang

```console
 helm install -n istio-system istiod manifests/charts/istio-control/istio-discovery --set profile=openshift
```

4) `gateways` charts install a load balancer with `ingress` and `egress`.

Ingress secrets and access should be separated from the control plane.

```console

		inputFile   string
		wantErr     bool
	}{
		{
			name:        "errors if unable to unmarshal bytes",
			inputFile:   "",
			wantConfigs: 0,
			wantErr:     true,
		},
		{
			name:        "loads valid ztunnel config_dump",
			inputFile:   "testdata/dump.json",
			wantConfigs: 27,
			wantErr:     false,
		},
	}
	for _, tt := range tests {
		t.Run(tt.name, func(t *testing.T) {
			cw := &ConfigWriter{}

type EndpointCluster struct {
	address            string
	port               int
	cluster            string
	status             core.HealthStatus
	failedOutlierCheck bool
}

// Prime loads the clusters output into the writer ready for printing
func (c *ConfigWriter) Prime(b []byte) error {
	cd := clusters.Wrapper{}
	err := json.Unmarshal(b, &cd)
	if err != nil {

}

// includeConfigType is a flag to indicate whether to include the config type in the output
var includeConfigType bool

func SetPrintConfigTypeInSummary(p bool) {
	includeConfigType = p
}

// Prime loads the config dump into the writer ready for printing
func (c *ConfigWriter) Prime(b []byte) error {
	w := &configdump.Wrapper{}
	err := w.UnmarshalJSON(b)
	if err != nil {

            --set policy.enable=false \
            --set global.istioNamespace=istio-master
```

### Gateways

A cluster may use multiple Gateways, each with a different load balancer IP, domains and certificates.

Since the domain certificates are stored in the gateway namespace, it is recommended to keep each
gateway in a dedicated namespace and restrict access.

	assert.Equal(t, installReady.Load(), false)
	assert.Equal(t, watchReady.Load(), false)

	server := httptest.NewServer(router)
	defer server.Close()

	makeReq(t, server.URL, constants.LivenessEndpoint, http.StatusOK)
	makeReq(t, server.URL, constants.ReadinessEndpoint, http.StatusServiceUnavailable)

	installReady.Store(true)
	watchReady.Store(true)
	assert.Equal(t, installReady.Load(), true)

	}

	if !reflect.DeepEqual(netns1, netns2) {
		t.Fatalf("Expected the same Netns for the same uid, got %v and %v", netns1, netns2)
	}

	if counter.Load() != 2 {
		t.Fatalf("Expected openNetns to be called twice, got %d", counter.Load())
	}
}

func TestUpsertPodCacheWithNewInode(t *testing.T) {
	counter.Store(0)

	p := newPodNetnsCache(openNsTestOverrideWithInodes(1, 2))

- the new chart uses the default namespace service account, and doesn't require
additional RBAC permissions.

- simplified label structure. Label change is not supported on upgrade.

- for 'internal load balancer' you should deploy a separate gateway, in a different
namespace.

All ingress gateway have a "app:ingressgateway" label, used to identify it as an
ingress, and an "istio: ingressgateway$SUFFIX" label of Gateway selection.