&netlink.Route{Dst: &net.IPNet{IP: net.ParseIP(ip), Mask: net.CIDRMask(32, 32)}},
		netlink.RT_FILTER_DST)
	if err != nil {
		return nil, err
	}

	if len(routes) == 0 {
		return nil, fmt.Errorf("no routes found for %s", ip)
	}

	linkIndex := routes[0].LinkIndex
	return netlink.LinkByIndex(linkIndex)
}

// getPodNetNs finds the network namespace for a given pod. There is not a great way to do this. Network namespaces live

  // If no system-wide time zone database can be found a bundled version of the database is used instead.
  // If the time zone name becomes invalid during the lifetime of a CronJob or due to a change in host
  // configuration, the controller will stop creating new new Jobs and will create a system event with the
  // reason UnknownTimeZone.

			err = c.Cluster.UnmarshalTo(clusterTyped)
			if err != nil {
				return nil, err
			}
			clusters = append(clusters, clusterTyped)
		}
	}
	if len(clusters) == 0 {
		return nil, fmt.Errorf("no clusters found")
	}
	sort.Slice(clusters, func(i, j int) bool {
		iDirection, iSubset, iName, iPort := safelyParseSubsetKey(clusters[i].Name)
		jDirection, jSubset, jName, jPort := safelyParseSubsetKey(clusters[j].Name)

	if err != nil {
		return err
	}
	if len(secretDump.DynamicActiveSecrets) == 0 &&
		len(secretDump.DynamicWarmingSecrets) == 0 {
		fmt.Fprintln(c.Stdout, "No active or warming secrets found.")
		return nil
	}
	secretItems, err := sdscompare.GetEnvoySecrets(c.configDump)
	if err != nil {
		return err
	}

	secretWriter := sdscompare.NewSDSWriter(c.Stdout, sdscompare.TABULAR)

              }
             }
            ],
            "host_selection_retry_max_attempts": "5",
            "retriable_status_codes": [
             503
            ]
           },
           "cluster_not_found_response_code": "INTERNAL_SERVER_ERROR",
           "max_grpc_timeout": "0s"
          },
          "metadata": {
           "filter_metadata": {
            "istio": {

	}
	return err
}

// printDiffsTabular prints the secret in table format
func (w *sdsWriter) printDiffsTabular(statuses []SecretItemDiff) error {
	if len(statuses) == 0 {
		fmt.Fprintln(w.w, "No secrets found to diff.")
		return nil
	}
	tw := new(tabwriter.Writer).Init(w.w, 0, 5, 5, ' ', 0)
	fmt.Fprintln(tw, strings.Join(secretDiffColumns, "\t"))
	for _, status := range statuses {

				return nil, fmt.Errorf(" You must provide a proxyID in the query string, e.g. [%s]",
					"edsz?proxyID=istio-ingressgateway")

			case strings.Contains(eString, "404 page not found"):
				return HandlerForRetrieveDebugList(kubeClient, *centralOpts, writer, istioNamespace)

			case strings.Contains(eString, "querystring parameter 'resource' is required"):

Information about supported Istio versions can be found on the
[Support Announcements] page on Istio's website.

## Reporting a Vulnerability

Instructions for reporting a vulnerability can be found on the
[Istio Security Vulnerabilities] page. The Istio Product Security Working Group receives
vulnerability and security issue reports, and the company affiliation of the members of
the group can be found at [Early Disclosure Membership].

			outBufTrim := strings.TrimSpace(outBuf.String())

			if !c.isValid && strings.Compare(errMsgTrim, outBufTrim) != 0 {
				t.Fatalf("\nwanted: %v \nbut found: %v", errMsgTrim, outBufTrim)
			}

			if c.isValid && outBuf.Len() > 0 {
				t.Fatalf("\nwanted: %v \nbut found: %v", errMsgTrim, outBufTrim)
			}
			outBuf.Reset()
		})
	}

  // client needs to check the 'expiration' field in a response.
  // +optional
  optional int64 expirationSeconds = 4;

  // BoundObjectRef is a reference to an object that the token will be bound to.
  // The token will only be valid for as long as the bound object exists.
  // NOTE: The API server's TokenReview endpoint will validate the
  // BoundObjectRef, but other audiences may not. Keep ExpirationSeconds
  // small if you want prompt revocation.