if err != nil {
		return err
	}
	if len(profiles) == 0 {
		cmd.Println("No profiles available.")
	} else {
		cmd.Println("Istio configuration profiles:")
		sort.Strings(profiles)
		for _, profile := range profiles {
			cmd.Printf("    %s\n", profile)
		}
	}

	return nil

		if r := cmp.Compare(a.Namespace, b.Namespace); r != 0 {
			return r
		}
		return cmp.Compare(a.Name, b.Name)
	})
	fmt.Fprintln(w, "NAMESPACE\tPOLICY NAME\tACTION\tSCOPE")

	for _, pol := range pols {
		fmt.Fprintf(w, "%v\t%v\t%v\t%v\n",
			pol.Namespace, pol.Name, pol.Action, pol.Scope)
	}
	return w.Flush()
}

// PrintPolicyDump prints the relevant services in the config dump to the ConfigWriter stdout

      - "certificatesigningrequests/status"
    verbs: ["update", "create", "get", "delete", "watch"]
  - apiGroups: ["certificates.k8s.io"]
    resources:
      - "signers"
    resourceNames:
{{- range .Values.global.certSigners }}
    - {{ . | quote }}
{{- end }}
    verbs: ["approve"]
{{- end}}

  # Used by Istiod to verify the JWT tokens
  - apiGroups: ["authentication.k8s.io"]

	// if the namespace in the CR is provided, consider creating it too.
	if istioNamespace != "" {
		namespaces = append(namespaces, istioNamespace)
	}
	for _, ns := range namespaces {
		if err := operatorutil.CreateNamespace(kubeClient.Kube(), ns, "", opts.DryRun); err != nil {
			l.LogAndFatal(err)
		}
	}

	fmt.Fprintln(w, "NAME\tSTATUS\tLOCALITY\tCLUSTER")
	dump, err := c.retrieveSortedEndpointsSlice(filter)
	if err != nil {
		return err
	}
	for _, eds := range dump {
		for _, llb := range eds.Endpoints {
			for _, ep := range llb.LbEndpoints {
				addr := retrieveEndpointAddress(ep)
				if includeConfigType {
					addr = fmt.Sprintf("endpoint/%s", addr)
				}
				fmt.Fprintf(w, "%v\t%v\t%v\t%v\n",

  config: |-
    # defaultTemplates defines the default template to use for pods that do not explicitly specify a template
    {{- if .Values.sidecarInjectorWebhook.defaultTemplates }}
    defaultTemplates:
{{- range .Values.sidecarInjectorWebhook.defaultTemplates}}
    - {{ . }}
{{- end }}
    {{- else }}
    defaultTemplates: [sidecar]
    {{- end }}
    policy: {{ .Values.global.proxy.autoInject }}
    alwaysInjectSelector:

apiVersion: v1
kind: ServiceAccount
  {{- with .Values.imagePullSecrets }}
imagePullSecrets:
  {{- range . }}
  - name: {{ . }}
  {{- end }}
  {{- end }}
metadata:
  name: ztunnel
  namespace: {{ .Release.Namespace }}
  labels:
    {{- .Values.labels | toYaml | nindent 4}}
  annotations:
    {{- .Values.annotations | toYaml | nindent 4 }}
---
{{- if (eq .Values.platform "openshift") }}
apiVersion: rbac.authorization.k8s.io/v1

// K8S may not have received the pod IPs yet, and may not report the pod as having any.
func GetPodIPsIfPresent(pod *corev1.Pod) []netip.Addr {
	var podIPs []netip.Addr
	if len(pod.Status.PodIPs) != 0 {
		for _, pip := range pod.Status.PodIPs {
			ip := netip.MustParseAddr(pip.IP)
			podIPs = append(podIPs, ip)
		}
	} else if len(pod.Status.PodIP) != 0 {
		ip := netip.MustParseAddr(pod.Status.PodIP)
		podIPs = append(podIPs, ip)
	}

			execClientConfig: loggingConfig,
			args:             strings.Split("log ztunnel-9v7nw --level debug", " "),
			expectedString:   "current log level is debug",
			wantException:    false,
		},
	}

	for i, c := range cases {
		t.Run(fmt.Sprintf("case %d %s", i, strings.Join(c.args, " ")), func(t *testing.T) {
			verifyExecTestOutput(t, ZtunnelConfig(cli.NewFakeContext(&cli.NewFakeContextOption{
				Results:   c.execClientConfig,

	}
}

func TestPodsAppearsWithNilNetnsWhenEnsureIsUsed(t *testing.T) {
	p := newPodNetnsCache(openNsTestOverride)

	p.Ensure("123")

	found := false
	snap := p.ReadCurrentPodSnapshot()
	for k, v := range snap {
		if k == "123" && v == (WorkloadInfo{}) {
			found = true
		}
	}
	if !found {
		t.Fatalf("expected pod 123 to be in the cache")
	}
}

func TestUpsertPodCacheWithLiveNetns(t *testing.T) {