},
		{
			// This is not a NXDOMAIN, but empty response
			name: "success: Error response if only AAAA records exist for typeA",
			host: "ipv6.localhost.",
		},
		{
			// This is not a NXDOMAIN, but empty response
			name:      "success: Error response if only A records exist for typeAAAA",
			host:      "ipv4.localhost.",
			queryAAAA: true,
		},
		{

	"istio.io/istio/pkg/ptr"
)

// delayedClient is a client wrapper that initially starts with an "empty client",
// but can later be swapped with a real client.
// The "empty client" returns empty responses for all reads, and fails all writes.
type delayedClient[T controllers.ComparableObject] struct {
	inf *atomic.Pointer[Informer[T]]

	delayed kubetypes.DelayedFilter

	hm       sync.Mutex

	"sigs.k8s.io/yaml"

	"istio.io/istio/istioctl/pkg/util/configdump"
	sdscompare "istio.io/istio/istioctl/pkg/writer/compare/sds"
	"istio.io/istio/pkg/util/protomarshal"
)

// ConfigWriter is a writer for processing responses from the Envoy Admin config_dump endpoint
type ConfigWriter struct {
	Stdout     io.Writer
	configDump *configdump.Wrapper
}

// includeConfigType is a flag to indicate whether to include the config type in the output

	_, _ = fmt.Fprintf(buf, "Errors:              %v\n", r.Error)

	return buf.String()
}

func (r *Result) add(result echo.CallResult, err error) {
	count := result.Responses.Len()
	if count == 0 {
		count = 1
	}

	r.TotalRequests += count
	if err != nil {
		r.Error = multierror.Append(r.Error, fmt.Errorf("request %d: %v", r.TotalRequests, err))
	} else {

	v3 "istio.io/istio/pilot/pkg/xds/v3"
	"istio.io/istio/pkg/config/host"
	istiolog "istio.io/istio/pkg/log"
)

// Support generation of 'ApiListener' LDS responses, used for native support of gRPC.
// The same response can also be used by other apps using XDS directly.

// GRPC proposal:
// https://github.com/grpc/proposal/blob/master/A27-xds-global-load-balancing.md
//

	Get() (T, error)
}

type lazyImpl[T any] struct {
	getter func() (T, error)
	// retry, if true, will ensure getter() is called for each Get() until a non-nil error is returned.
	retry bool

	// Cached responses. Note: with retry enabled, this will be unset until a non-nil error
	res T
	err error

	done uint32
	m    sync.Mutex
}

var _ Lazy[any] = &lazyImpl[any]{}

// (right now calls it from initDiscoveryService in pkg/bootstrap/server.go).
func (r *JwksResolver) Close() {
	closeChan <- true
}

// Compare two JWKS responses, returning true if there is a difference and false otherwise
func compareJWKSResponse(oldKeyString string, newKeyString string) (bool, error) {
	if oldKeyString == newKeyString {
		return false, nil
	}

// and supports *on-demand* client usage. A client can subscribe with a wildcard subscription and get all
// resources (with delta updates), or on-demand and only get responses for specifically subscribed resources.
//
// Incoming requests may be for VIP or Pod IP addresses. However, all responses are Workload resources, which are pod based.
// This means subscribing to a VIP may end up pushing many resources of different name than the request.

		addresses = append(addresses, podIP.IP)
	}
	w.mutex.Unlock()
	return addresses
}

func (w *workload) ForwardEcho(ctx context.Context, request *proto.ForwardEchoRequest) (echoClient.Responses, error) {
	w.mutex.Lock()
	c := w.client
	if c == nil {
		w.mutex.Unlock()
		return nil, fmt.Errorf("failed forwarding echo for disconnected pod %s/%s",
			w.pod.Namespace, w.pod.Name)
	}

package configdump

import (
	"encoding/json"
	"fmt"
	"io"
	"text/tabwriter"

	"sigs.k8s.io/yaml"

	"istio.io/istio/pkg/maps"
)

// ConfigWriter is a writer for processing responses from the Ztunnel Admin config_dump endpoint
type ConfigWriter struct {
	Stdout      io.Writer
	ztunnelDump *ZtunnelDump
	FullDump    []byte
}

type rawDump struct {