// no calls to ztunnel if iptables failed
	assert.Equal(t, ztunnelServer.addedPods.Load(), 0)

	// error is not partial error
	if errors.Is(err, ErrPartialAdd) {
		t.Fatal("expected not a partial error")
	}
}

func TestConstructInitialSnap(t *testing.T) {
	ctx, cancel := context.WithCancel(context.Background())
	defer cancel()
	setupLogging()

				args = append(args, "--watchedNamespaces", test.watchedNamespaces)
			}

			kubeClientFunc = func() (kube.CLIClient, error) {
				return nil, nil
			}
			rootCmd := GetRootCmd(cli.NewFakeContext(&cli.NewFakeContextOption{
				Version: "25",
			}), args)
			err := rootCmd.Execute()
			assert.NoError(t, err)

			readActions := map[string]bool{
				"get":   true,
				"list":  true,
				"watch": true,
			}

		constants.DataplaneMode, constants.DataplaneModeAmbient))
	_, err := client.Kube().CoreV1().Namespaces().Patch(ctx, ns.Name,
		types.MergePatchType, labelsPatch, metav1.PatchOptions{})
	assert.NoError(t, err)

	waitForMockCalls()

	assertPodAnnotated(t, client, pod)

	// Assert expected calls actually made
	fs.AssertExpectations(t)
}

func TestExistingPodAddedWhenDualStack(t *testing.T) {

	cw.Prime(cd)
	err := cw.PrintEcdsSummary()
	assert.NoError(t, err)

	util.CompareContent(t, gotOut.Bytes(), "testdata/ecds/output.txt")
}

func TestPrintEcdsYaml(t *testing.T) {
	gotOut := &bytes.Buffer{}
	cw := &ConfigWriter{Stdout: gotOut}
	cd, _ := os.ReadFile("testdata/ecds/configdump.json")
	cw.Prime(cd)
	err := cw.PrintEcds("yaml")
	assert.NoError(t, err)

			if tc.error == "" && err != nil {
				t.Fatalf("expected no error, got %v", err)
			}
			if tc.error != "" {
				if err == nil {
					t.Fatalf("expected error to include \"%s\" but got none", tc.error)
				}
				if !strings.Contains(err.Error(), tc.error) {
					t.Fatalf("expected \"%s\" in error, got %v", tc.error, err)
				}
			}
		})
	}

func (m *MockedIpsetDeps) deleteIP(name string, ip netip.Addr, ipProto uint8) error {
	args := m.Called(name, ip, ipProto)
	return args.Error(0)
}

func (m *MockedIpsetDeps) flush(name string) error {
	args := m.Called(name)
	return args.Error(0)
}

func (m *MockedIpsetDeps) clearEntriesWithComment(name, comment string) error {
	args := m.Called(name, comment)
	return args.Error(0)
}

			gotOut := &bytes.Buffer{}
			cw := &ConfigWriter{Stdout: gotOut}
			cd, _ := os.ReadFile("testdata/endpoint/configdump.json")
			cw.Prime(cd)
			err := cw.PrintEndpointsSummary(tt.filter)
			assert.NoError(t, err)

			wantOutputFile := path.Join("testdata/endpoint", fmt.Sprintf("%s_output.txt", tt.name))
			util.CompareContent(t, gotOut.Bytes(), wantOutputFile)
		})
	}
}

func TestPrintEndpoints(t *testing.T) {

			case err == nil:
				log.Warn("ztunnel protocol error, unexpected message")
				return fmt.Errorf("ztunnel protocol error, unexpected message")
			default:
				// we get here if error is deadline exceeded, which means ztunnel is alive.
			}

		case <-ctx.Done():
			return nil
		}
	}
}

func (z *ztunnelServer) PodDeleted(ctx context.Context, uid string) error {
	r := &zdsapi.WorkloadRequest{

	var istioMap map[string]any
	err := json.Unmarshal(newCNIConfig, &istioMap)
	if err != nil {
		return nil, fmt.Errorf("error loading Istio CNI config (JSON error): %v", err)
	}

	var existingMap map[string]any
	err = json.Unmarshal(existingCNIConfig, &existingMap)
	if err != nil {
		return nil, fmt.Errorf("error loading existing CNI config (JSON error): %v", err)
	}

// sysexits to signify some error running istioctl, and use 79-125 as custom
// error codes for other info that we'd like to use to pass info on.
const (
	ExitUnknownError   = 1 // for compatibility with existing exit code
	ExitIncorrectUsage = 64
	ExitDataError      = 65 // some format error with input data

	// below here are non-zero exit codes that don't indicate an error with istioctl itself