Items: []admitv1.MutatingWebhookConfiguration{revisionCanonicalWebhook},
			},
			namespaces:    corev1.NamespaceList{},
			outputMatches: []string{},
			error:         "cannot create revision tag \"revision\"",
		},
	}

	for _, tc := range tcs {
		t.Run(tc.name, func(t *testing.T) {
			var out bytes.Buffer

		l.LogAndPrintf("Rendering: %s", componentName)
		dirName := filepath.Join(outputDir, componentName)
		if !dryRun {
			if err := os.MkdirAll(dirName, os.ModePerm); err != nil {
				return fmt.Errorf("could not create directory %s; %s", outputDir, err)
			}
		}
		fname := filepath.Join(dirName, componentName) + ".yaml"
		l.LogAndPrintf("Writing manifest to %s", fname)
		if !dryRun {

doubt re-run istioctl kube-inject on deployments to get the most up-to-date changes.

It's best to do kube-inject when the resource is initially created.
`,
		Example: `  # Update resources on the fly before applying.
  kubectl apply -f <(istioctl kube-inject -f <resource.yaml>)

  # Create a persistent version of the deployment with Istio sidecar injected.
  istioctl kube-inject -f deployment.yaml -o deployment-injected.yaml

		Example: `  # Create a secret to access cluster c0's apiserver and install it in cluster c1.
  istioctl --kubeconfig=c0.yaml create-remote-secret --name c0 \
    | kubectl --kubeconfig=c1.yaml apply -f -

  # Delete a secret that was previously installed in c1
  istioctl --kubeconfig=c0.yaml create-remote-secret --name c0 \
    | kubectl --kubeconfig=c1.yaml delete -f -

			if err != nil {
				t.Fatalf("could not parse webhook from generated YAML: %s", vwhObject)
			}
			wh := vwhObject.(*admitv1.ValidatingWebhookConfiguration)

			if tc.userManaged {
				// User created webhooks should not have operator labels, otherwise will be pruned.
				_, ok := wh.GetLabels()[operatorManaged]
				assert.Equal(t, ok, false)
			}

			for _, webhook := range wh.Webhooks {

}

func tagSetCommand(ctx cli.Context) *cobra.Command {
	cmd := &cobra.Command{
		Use:   "set <revision-tag>",
		Short: "Create or modify revision tags",
		Long: `Create or modify revision tags. Tag an Istio control plane revision for use with namespace istio.io/rev
injection labels.`,
		Example: `  # Create a revision tag from the "1-8-0" revision
  istioctl tag set prod --revision 1-8-0

				tt.Errorf("got\n%v\nwant\n%vdiff %v", got, c.want, diff)
			}
		})
	}

	t.Run("kubernetes created secret (legacy)", func(t *testing.T) {
		for _, c := range legacyCases {
			doCase(t, c, "23")
		}
	})
	t.Run("istioctl created secret", func(t *testing.T) {
		for _, c := range cases {
			doCase(t, c, "")
		}
	})
}

		}
	}
	return present, notpresent, sdcnum, nil
}

// getAndWatchResource ensures that Generations always contains
// the current generation of the targetResource, adding new versions
// as they are created.
func getAndWatchResource(ictx context.Context, cliCtx cli.Context) *watcher {
	g := withContext(ictx)
	// copy nameflag to avoid race
	nf := nameflag
	g.Go(func(result chan string) error {

			watchServerReady.Store(true)
		}

		installer := install.NewInstaller(&cfg.InstallConfig, installDaemonReady)

		repair.StartRepair(ctx, cfg.RepairConfig)

		log.Info("Installer created, watching node CNI dir")
		// installer.Run() will block indefinitely, and attempt to permanently "keep"
		// the CNI binary installed.
		if err = installer.Run(ctx); err != nil {

	resultLabel                   = monitoring.CreateLabel("result")
	resultSuccess                 = "SUCCESS"
	resultCopyBinariesFailure     = "COPY_BINARIES_FAILURE"
	resultCreateKubeConfigFailure = "CREATE_KUBECONFIG_FAILURE"
	resultCreateCNIConfigFailure  = "CREATE_CNI_CONFIG_FAILURE"

	cniInstalls = monitoring.NewSum(
		"istio_cni_installs_total",
		"Total number of CNI plugins installed by the Istio CNI installer",
	)