"x-goog-user-project": c.project,
	}
	if err := updateAuthHdrs(ctx, uri, "k8s", c.k8sCreds, ret, "x-mesh-authorization"); err != nil {
		return nil, err
	}
	if err := updateAuthHdrs(ctx, uri, "gcp", c.gcpCreds, ret, "authorization"); err != nil {
		return nil, err
	}
	return ret, nil
}

func (*meshAuthCredentials) RequireTransportSecurity() bool {
	return true
}

	webhooks, err := client.AdmissionregistrationV1().MutatingWebhookConfigurations().List(ctx, metav1.ListOptions{
		LabelSelector: label.IoIstioRev.Name,
	})
	if err != nil {
		return nil, err
	}
	return webhooks.Items, nil
}

// GetWebhooksWithTag returns webhooks tagged with istio.io/tag=<tag>.

	if c.configDump == nil {
		return fmt.Errorf("config writer has not been primed")
	}

	dump, err := c.configDump.GetEcdsConfigDump()
	if err != nil {
		return err
	}

	out, err := protomarshal.MarshalIndentWithGlobalTypesResolver(dump, "    ")
	if err != nil {
		return err
	}
	if outputFormat == "yaml" {
		if out, err = yaml.JSONToYAML(out); err != nil {
			return err
		}
	}

}

// GetListenerConfigDump retrieves the listener config dump from the ConfigDump
func (w *Wrapper) GetListenerConfigDump() (*admin.ListenersConfigDump, error) {
	listenerDumpAny, err := w.getSection(listeners)
	if err != nil {
		return nil, err
	}
	listenerDump := &admin.ListenersConfigDump{}
	err = listenerDumpAny.UnmarshalTo(listenerDump)
	if err != nil {
		return nil, err
	}

		meta, err = secretMetaFromCert([]byte(s.data))
		if err != nil {
			log.Debugf("failed to parse secret resource %s from source %s: %v",
				s.name, s.source, err)
			result.Valid = false
			return result, nil
		}
		result.SecretMeta = meta
		result.Valid = meta.Valid
		return result, nil
	}
	result.Valid = false
	return result, nil
}

	bootstrapDumpAny, err := w.getSection(bootstrap)
	if err != nil {
		return nil, err
	}
	bootstrapDump := &admin.BootstrapConfigDump{}
	err = bootstrapDumpAny.UnmarshalTo(bootstrapDump)
	if err != nil {
		return nil, err
	}
	return bootstrapDump, nil

	var dumpAny *anypb.Any
	for _, conf := range w.Configs {
		if conf.TypeUrl == string(sectionTypeURL) {
			dumpAny = conf
		}
	}
	if dumpAny == nil {
		return nil, fmt.Errorf("config dump has no configuration type %s", sectionTypeURL)
	}

	return dumpAny, nil
}

func (w *Wrapper) getSections(sectionTypeURL configTypeURL) ([]*anypb.Any, error) {
	var dumpAny []*anypb.Any
	for _, conf := range w.Configs {

		var d net.Dialer
		return d.DialContext(ctx, "unix", socket)
	}))

	conn, err := grpc.Dial(socket, opts...)
	if err != nil {
		return nil, err
	}

	return conn, nil

		rules = append(rules, inpodMarkRule)
	}

	for _, rule := range rules {
		log.Debugf("Iterating netlink rule : %+v", rule)
		if err := f(rule); err != nil {
			return fmt.Errorf("failed to configure netlink rule: %w", err)
		}
	}

	return nil
}

func AddLoopbackRoutes(cfg *Config) error {
	return forEachLoopbackRoute(cfg, netlink.RouteReplace)
}

func DelLoopbackRoutes(cfg *Config) error {

	for _, tt := range tests {
		t.Run(tt.name, func(t *testing.T) {
			cw := &ConfigWriter{}
			cd, _ := os.ReadFile(tt.inputFile)
			err := cw.Prime(cd)
			if cw.configDump == nil {
				if tt.wantConfigs != 0 {
					t.Errorf("wanted some configs loaded but config dump was nil")
				}
			} else if len(cw.configDump.Configs) != tt.wantConfigs {
				t.Errorf("wanted %v configs loaded in got %v", tt.wantConfigs, len(cw.configDump.Configs))
			}