// the kernel can be out of sync with the CLI utility, leading to errors like:
//
// ipset v7.10: Argument `comment' is supported in the kernel module of the set type hash:ip
// starting from the revision 3 and you have installed revision 1 only.
// Your kernel is behind your ipset utility.
//
// This happens with kernels as recent as Fedora38, e.g: 6.4.11-200.fc38.aarch64

under the `kubelet` process. On systems with `journalctl` the following is an example command line
to view the last 1000 `kubelet` logs via the `less` utility to allow for `vi`-style searching:

```console
$ journalctl -t kubelet -n 1000 | less
```

#### GKE via Stackdriver Log Viewer

	rootCmd := &cobra.Command{
		Use:          "mesh",
		Short:        "Command line Istio install utility.",
		SilenceUsage: true,
		Long: "This command uses the Istio operator code to generate templates, query configurations and perform " +
			"utility operations.",
	}
	rootCmd.SetArgs(args)
	rootCmd.PersistentFlags().AddGoFlagSet(flag.CommandLine)

	rootCmd.AddCommand(ManifestCmd(ctx))

)

var labelPairs string

func Cmd(ctx cli.Context) *cobra.Command {
	cmd := &cobra.Command{
		Use:   "check-inject [<type>/]<name>[.<namespace>]",
		Short: "Check the injection status or inject-ability of a given resource, explains why it is (or will be) injected or not",
		Long: `
Checks associated resources of the given resource, and running webhooks to examine whether the pod can be or will be injected or not.`,

simplified configuration -- multiple versions of the ingress can be used, to minimize upgrade risks - the new chart uses the default namespace service account, and doesn't require additional RBAC permissions. - simplified label and chart structure. - ability to run a pilot dedicated for the gateway, isolated from the main pilot. This is more robust, safer on upgrades and allows a bit more flexibility. - the dedicated pilot-per-ingress is required if the gateway needs to support k8s-style ingress. # Port...

core components, install artifacts, and sample programs. It includes:

    - [istioctl](istioctl/). This directory contains code for the
[_istioctl_](https://istio.io/latest/docs/reference/commands/istioctl/) command line utility.

    - [operator](operator/). This directory contains code for the
[Istio Operator](https://istio.io/latest/docs/setup/install/operator/).

    - [pilot](pilot/). This directory

		Use:               "istioctl",
		Short:             "Istio control interface.",
		SilenceUsage:      true,
		DisableAutoGenTag: true,
		PersistentPreRunE: ConfigureLogging,
		Long: `Istio configuration command line utility for service operators to
debug and diagnose their Istio mesh.
`,
	}

	rootCmd.SetArgs(args)

	flags := rootCmd.PersistentFlags()
	rootOptions := cli.AddRootFlags(flags)

// 	b: [ 10.10.1.1:309, 10.10.2.2:309 ]
message EndpointSubset {
  // IP addresses which offer the related ports that are marked as ready. These endpoints
  // should be considered safe for load balancers and clients to utilize.
  // +optional
  repeated EndpointAddress addresses = 1;

  // IP addresses which offer the related ports but are not currently marked as ready

  // ---
  // Many .condition.type values are consistent across resources like Available, but because arbitrary conditions can be
  // useful (see .node.status.conditions), the ability to deconflict is important.
  // The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt)
  // +required
  // +kubebuilder:validation:Required

Typically, the whole `kclient.Client` is used,though.

Functionality offered by `kclient` includes:
* Typed clients (via generics) and more ergonomic APIs
* Ability to make a _delayed_ client. This is used when making clients based on CRDs that may not exist.
  In general, Istio does not fail on missing CRDs and prefers to treat these as if there were just zero resources for that client.