ip6tablesBin        = "ip6tables"
	ip6tablesNftBin     = "ip6tables-nft"
	ip6tablesLegacyBin  = "ip6tables-legacy"
	iptablesRestoreBin  = "iptables-restore"
	ip6tablesRestoreBin = "ip6tables-restore"
)

// It is not sufficient to check for the presence of one binary or the other in $PATH -
// we must choose a binary that is
// 1. Available in our $PATH
// 2. Matches where rules are actually defined in the netns we're operating in

		// waypoints never use selector
		if p.IsWaypoint || !features.EnableSelectorBasedK8sGatewayPolicy {
			log.Debugf("Ignoring workload-scoped %s/%s %s for gateway %s.%s because it has no targetRef", kind.Group, kind.Kind, policyName, gatewayName, p.Namespace)
			return false
		}
		return p.isSelected(policy)
	}

	for _, targetRef := range targetRefs {
		target := types.NamespacedName{

				"indicating the binary size has decreased. The test will fail to ensure you update the test thresholds to ensure "+
				"the improvements are 'locked in'.", got, tt.minMb)
		}
	})
}

// If this flag is present, it means "testing" was imported by code that is built by the binary
var denylistedFlags = []string{
	"--test.memprofilerate",
}

func runBinariesTest(t *testing.T, f func(t *testing.T, name string)) {
	t.Helper()

		}
		return key, nil
	default:
		return nil, fmt.Errorf("unsupported PEM block type for a private key: %s", kb.Type)
	}
}

// GetRSAKeySize returns the size if it is RSA key, otherwise it returns an error.
func GetRSAKeySize(privKey crypto.PrivateKey) (int, error) {
	if t := reflect.TypeOf(privKey); t != reflect.TypeOf(&rsa.PrivateKey{}) {
		return 0, fmt.Errorf("key type is not RSA: %v", t)
	}

	Sidecar echo.Instances

	// All echo services
	All echo.Instances
}

// TestMain defines the entrypoint for pilot tests using a standard Istio installation.
// If a test requires a custom install it should go into its own package, otherwise it should go
// here to reuse a single install across tests.
func TestMain(m *testing.M) {
	// nolint: staticcheck
	framework.
		NewSuite(m).
		RequireMinVersion(24).

    # When processing a leaf namespace Istio will search for declarations in that namespace first
    # and if none are found it will search in the root namespace. Any matching declaration found in the root namespace
    # is processed as if it were declared in the leaf namespace.
    rootNamespace: {{ .Values.meshConfig.rootNamespace | default .Values.global.istioNamespace }}

	// since the IP is normally the same), we SNAT identified host probes in the host netns to a fixed
	// APIPA/"link-local" IP.
	//
	// It doesn't matter what this IP is, so long as it's not routable and doesn't collide with anything else.
	//
	// IPv6 link local ranges are designed to be collision-resistant by default, and so probably never need to be overridden

	"istio.io/istio/pkg/test/framework/config"
	"istio.io/istio/pkg/test/framework/resource"
	"istio.io/istio/pkg/test/scopes"
)

// Environment is the implementation of a kubernetes environment. It implements environment.Environment,
// and also hosts publicly accessible methods that are specific to cluster environment.
type Environment struct {
	id       resource.ID
	ctx      resource.Context
	clusters []cluster.Cluster

)

// GatewayConformanceInputs defines inputs to the gateway conformance test.
// The upstream build requires using `testing.T` types, which we cannot pass using our framework.
// To workaround this, we set up the inputs it TestMain.
type GatewayConformanceInputs struct {
	Client  kube.CLIClient
	Cleanup bool
}

var gatewayConformanceInputs GatewayConformanceInputs

// defined in sigs.k8s.io/gateway-api/conformance/base/manifests.yaml

apiVersion: v2
name: ztunnel
# This version is never actually shipped. istio/release-builder will replace it at build-time
# with the appropriate version
version: 1.0.0
appVersion: 1.0.0
description: Helm chart for istio ztunnel components
keywords:
  - istio-ztunnel
  - istio
sources:
  - https://github.com/istio/istio