"serviceAccount": "httpbin",
      "workloadName": "httpbin",
      "workloadType": "deployment",
      "canonicalName": "httpbin",
      "canonicalRevision": "v1",
      "node": "ambient-worker",
      "status": "Healthy",
      "clusterId": "Kubernetes"
    },
    "/10.244.2.8": {
      "workloadIps": [
        "10.244.2.8"
      ],
      "protocol": "TCP",

default            reviews-v3-5b9bd44f4-z9ms4                           10.244.1.43 ambient-worker        None                                HBONE
default            sleep-7656cf8794-lxcmx                               10.244.2.58 ambient-worker2       None                                HBONE

default   details-v1-698d88b-krdw7       10.244.2.55 ambient-worker2 None     HBONE
default   httpbin-7447985f87-t8hv7       10.244.1.40 ambient-worker  None     TCP
default   productpage-v1-675fc69cf-kkrm2 10.244.2.56 ambient-worker2 None     HBONE
default   ratings-v1-6484c4d9bb-8xc2r    10.244.2.57 ambient-worker2 None     HBONE
default   reviews-v1-5b5d6494f4-c7z5w    10.244.1.41 ambient-worker  None     HBONE

# This manifest installs the Istio install-cni container, as well
# as the Istio CNI plugin and config on
# each master and worker node in a Kubernetes cluster.
{{- $defaultBinDir :=
    (.Capabilities.KubeVersion.GitVersion | contains "-gke") | ternary
      "/home/kubernetes/bin"
      "/opt/cni/bin"
}}
kind: DaemonSet
apiVersion: apps/v1
metadata:
  name: istio-cni-node
  namespace: {{ .Release.Namespace }}
  labels:

  istioctl x ztunnel-config workload

  # Retrieve summary of workloads on node XXXX for a given Ztunnel instance.
  istioctl x ztunnel-config workload <ztunnel-name[.namespace]> --node ambient-worker

  # Retrieve full workload dump of workloads with address XXXX for a given Ztunnel instance.
  istioctl x ztunnel-config workload <ztunnel-name[.namespace]> --address 0.0.0.0 -o json

  // +optional
  // +patchMergeKey=type
  // +patchStrategy=merge
  repeated NamespaceCondition conditions = 2;
}

// Node is a worker node in Kubernetes.
// Each node will have a unique identifier in the cache (i.e. in etcd).
message Node {
  // Standard object's metadata.

	compareConfResult(resultFile, expectedOutputFile, t)
	t.Log("PASS: Istio CNI configuration still valid after removal")

	// Shutdown the install-cni
	cancel()
	wg.Wait()

	t.Logf("Check the cleanup worked")
	if chainedCNIPlugin {
		if len(expectedPostCleanFile) == 0 {
			compareConfResult(resultFile, wd+cniConfSubDir+preConfFile, t)
		} else {
			compareConfResult(resultFile, expectedPostCleanFile, t)
		}

	// within all pods as we do on the host.
	//
	// This should be fine, as the host binaries are all we have to work with here anyway,
	// as we are running within a privileged container - and we don't want to take the time to
	// redetect for each pod anyway.
	//
	// Extreme corner case:
	// If for some reason your host had both binaries, and you were injecting out-of-band

CONDITIONAL_HOST_MOUNTS="${CONDITIONAL_HOST_MOUNTS:-} "
container_kubeconfig=''

# docker conditional host mount (needed for make docker push)
if [[ -d "${HOME}/.docker" ]]; then
  CONDITIONAL_HOST_MOUNTS+="--mount type=bind,source=${HOME}/.docker,destination=/config/.docker,readonly "
fi

# gcloud conditional host mount (needed for docker push with the gcloud auth configure-docker)
if [[ -d "${HOME}/.config/gcloud" ]]; then

        track: stable
    spec:
      containers:
      - image: fake.docker.io/google-samples/hello-go-gke:1.0
        name: hello
        ports:
        - containerPort: 80
          name: http
        resources: {}
      - image: docker.io/istio/proxy_debug:unittest
        name: istio-proxy
        resources: {}
      initContainers:
      - image: docker.io/istio/proxy_init:unittest-testiop
        name: istio-init