}
			if err := f.Start(); err != nil {
				return nil, err
			}
			address = fmt.Sprintf("https://%s%s", f.Address(), *cc.Service.Path)
			defer func() {
				f.Close()
				f.WaitForStop()
			}()
		}
		tlsClientConfig.ServerName = fmt.Sprintf("%s.%s.%s", cc.Service.Name, cc.Service.Namespace, "svc")
	} else if isMCPAddr(address) {
		var err error

				return fmt.Errorf("could not start port forwarder for ControlZ %s: %v", podName, err)
			}

			ctrlzClient := &ControlzClient{
				baseURL: &url.URL{
					Scheme: "http",
					Host:   portForwarder.Address(),
					Path:   "scopej",
				},
				httpClient: &http.Client{},
			}
			istiodConfigCmd := chooseClientFlag(ctrlzClient, istiodReset, outputLogLevel, stackTraceLevel, outputFormat)

		ep := mustGetEndpoint(g, objs, "istiod-remote").Unstructured()
		g.Expect(ep).Should(HavePathValueEqual(PathValue{"subsets.[0].addresses.[0]", endpointSubsetAddressVal("", "169.10.112.88", "")}))
		g.Expect(ep).Should(HavePathValueContain(PathValue{"subsets.[0].ports.[0]", portVal("tcp-istiod", 15012, -1)}))

		checkClusterRoleBindingsReferenceRoles(g, objs)

type CNIEventClient struct {
	client *http.Client
	url    string
}

func buildClient(address, path string) CNIEventClient {
	c := &http.Client{
		Transport: &http.Transport{
			DialContext: func(_ context.Context, _, _ string) (net.Conn, error) {
				return net.Dial("unix", address)
			},
		},
		Timeout: 1000 * time.Millisecond,
	}
	eventC := CNIEventClient{
		client: c,

var settableFlags = map[string]env.VariableInfo{
	"istioNamespace":      env.Register("ISTIOCTL_ISTIONAMESPACE", constants.IstioSystemNamespace, "The istioctl --istioNamespace override"),
	"xds-address":         env.Register("ISTIOCTL_XDS_ADDRESS", "", "The istioctl --xds-address override"),
	"xds-port":            env.Register("ISTIOCTL_XDS_PORT", 15012, "The istioctl --xds-port override"),

	"istio.io/istio/cni/pkg/constants"
	"istio.io/istio/cni/pkg/nodeagent"
	"istio.io/istio/pkg/test/util/assert"
)

func fakeCNIEventClient(address string) CNIEventClient {
	c := http.DefaultClient

	eventC := CNIEventClient{
		client: c,
		url:    address + constants.CNIAddEventPath,
	}
	return eventC
}

var fakeCmdArgs = &skel.CmdArgs{
	Netns:       "someNetNS",
	IfName:      "ethBro",

	fakePodIP := "11.1.1.12"
	_, addr, _ := net.ParseCIDR(fakePodIP + "/32")
	valid := CNIPluginAddEvent{
		Netns:        "/var/netns/foo",
		PodName:      "pod-bingo",
		PodNamespace: "funkyns",
		IPs: []IPConfig{{
			Address: *addr,
		}},
	}

	setupLogging()
	NodeName = "testnode"
	ctx, cancel := context.WithCancel(context.Background())
	defer cancel()
	pod := &corev1.Pod{
		ObjectMeta: metav1.ObjectMeta{

	registerStringParameter(constants.CNIEventAddress, "/var/run/istio-cni/pluginevent.sock",
		"The UDS server address which CNI plugin will forward ambient pod creation events to")
	registerStringParameter(constants.ZtunnelUDSAddress, "/var/run/ztunnel/ztunnel.sock", "The UDS server address which ztunnel will connect to")

	versionCmd.Example = `  # Retrieve version information directly from the control plane, using token security
  # (This is the usual way to get the control plane version with an out-of-cluster control plane.)
  istioctl x version --xds-address istio.cloudprovider.example.com:15012

  # Retrieve version information via Kubernetes config, using token security
  # (This is the usual way to get the control plane version with an in-cluster control plane.)

	"google.golang.org/grpc/credentials"

	"istio.io/istio/pkg/kube"
)

type MockPortForwarder struct{}

func (m MockPortForwarder) Start() error {
	return nil
}

func (m MockPortForwarder) Address() string {
	return "localhost:3456"
}

func (m MockPortForwarder) Close() {
}

func (m MockPortForwarder) ErrChan() <-chan error {
	return make(chan error)
}

func (m MockPortForwarder) WaitForStop() {