makeGateway(constants.DefaultNamespaceWaypoint, "default", true, true),
				makeGateway(constants.DefaultNamespaceWaypoint, "fake", true, true),
			},
			expectedOutFile: "default-gateway",
		},
		{
			name: "all namespaces gateways",
			args: strings.Split("list -A", " "),
			gateways: []*gateway.Gateway{
				makeGateway(constants.DefaultNamespaceWaypoint, "default", true, true),

package cmd

import (
	"github.com/spf13/cobra"
	"github.com/spf13/pflag"
)

var helpFlags = map[string]bool{
	"log_as_json":          true,
	"log_stacktrace_level": true,
	"log_target":           true,
	"log_caller":           true,
	"log_output_level":     true,
	// istioctl also inherits support for log_rotate, log_rotate_max_age, log_rotate_max_backups,

			verifyTestcaseOutput(t, Cmd(cli.NewFakeContext(nil)), c)
		})
	}
}

var generated = map[string]bool{
	"hosts":         true,
	"istio-token":   true,
	"mesh.yaml":     true,
	"root-cert.pem": true,
	"cluster.env":   true,
}

const goldenSuffix = ".golden"

// TestWorkloadEntryConfigure enumerates test cases based on subdirectories of testdata/vmconfig.

			state:   &resetState{client: ctrzClientNoScopejHandler},
			wantErr: true,
		},
		{
			name: "logLevelState.run() should throw an error if the /scopej endpoint is missing",
			state: &logLevelState{
				client:         ctrzClientNoScopejHandler,
				outputLogLevel: "test:debug",
			},
			wantErr: true,
		},
		{

type WorkloadFilter struct {
	Address   string
	Node      string
	Verbose   bool
	Namespace string
}

// Verify returns true if the passed workload matches the filter fields
func (wf *WorkloadFilter) Verify(workload *ZtunnelWorkload) bool {
	if wf.Address == "" && wf.Node == "" && wf.Namespace == "" {
		return true
	}

	if wf.Namespace != "" {
		if !strings.EqualFold(workload.Namespace, wf.Namespace) {
			return false
		}
	}

		{
			args:       "profile diff demo default --unknown-flag",
			shouldFail: true,
		},
		{
			args:       "profile diff demo",
			shouldFail: true,
		},
		{
			args:       "profile diff",
			shouldFail: true,
		},
		{
			args:       fmt.Sprintf("profile diff default unknown-profile --manifests %s", snapshotCharts),
			shouldFail: true,
		},
		{

			} else if nsLabel != "" {
				outMsg := fmt.Sprintf("Namespace label %s matches", nsLabel)
				if strings.Contains(nsLabel, "kubernetes.io/metadata.name") {
					outMsg += " (Automatic injection is enabled in all namespaces)."
				}
				return outMsg, true
			} else if podLabel != "" {
				return fmt.Sprintf("Pod label %s matches", podLabel), true
			}
		} else if nsMatched {

			// TODO this only makes sense in context of a chain... do we need a way to give it context
			return []string{"ANY"}, true
		}
	case *matcher.Matcher_OnMatch_Matcher:
		ms, f := recurse(name, v.Matcher)
		if !f {
			return []string{"NONE"}, true
		}
		return ms, true
	}
	// TODO support list
	n := match.GetMatcherTree().GetInput().GetName()

	var m map[string]*matcher.Matcher_OnMatch

	envoyClusterDump, err := c.envoy.GetDynamicClusterDump(true)
	if err != nil {
		envoyBytes.WriteString(err.Error())
	} else {
		envoy, err := protomarshal.ToJSONWithAnyResolver(envoyClusterDump, "    ", &envoyResolver)
		if err != nil {
			return err
		}
		envoyBytes.WriteString(envoy)
	}
	istiodClusterDump, err := c.istiod.GetDynamicClusterDump(true)
	if err != nil {
		istiodBytes.WriteString(err.Error())
	} else {

	envoyListenerDump, err := c.envoy.GetDynamicListenerDump(true)
	if err != nil {
		envoyBytes.WriteString(err.Error())
	} else {
		envoy, err := protomarshal.ToJSONWithAnyResolver(envoyListenerDump, "    ", &envoyResolver)
		if err != nil {
			return err
		}
		envoyBytes.WriteString(envoy)
	}
	istiodListenerDump, err := c.istiod.GetDynamicListenerDump(true)
	if err != nil {
		istiodBytes.WriteString(err.Error())
	} else {