func (rs *resetState) run(_ io.Writer) error {
	const (
		defaultOutputLevel     = "info"
		defaultStackTraceLevel = "none"
	)
	allScopes, err := rs.client.GetScopes()
	if err != nil {
		return fmt.Errorf("could not get all scopes: %v", err)
	}
	var defaultScopes []*ScopeInfo
	for _, scope := range allScopes {
		defaultScopes = append(defaultScopes, &ScopeInfo{
			Name:            scope.Name,
			OutputLevel:     defaultOutputLevel,

	uid := fixture.uid

	m, fds := readRequest(t, ztunClient)
	// we got am essage from ztun, so it should have observed us being connected
	mt.Assert(ztunnelConnected.Name(), nil, monitortest.Exactly(1))

	// we should get the fd to dev null. note that we can't assert the fd number
	// as the kernel may have given us a different number that refers to the same file.
	assert.Equal(t, len(fds), 1)
	// in theory we should close the fd, but it's just a test..

import (
	"fmt"
	"io/fs"
	"syscall"
)

func GetInode(fi fs.FileInfo) (uint64, error) {
	if stat, ok := fi.Sys().(*syscall.Stat_t); ok {
		return stat.Ino, nil
	}
	return 0, fmt.Errorf("unable to get inode")

)

var (
	// IstioConfig is the name of the istioctl config file (if any)
	IstioConfig = env.Register("ISTIOCONFIG", defaultIstioctlConfig,
		"Default values for istioctl flags").Get()

	LoggingOptions = defaultLogOptions()

	// scope is for dev logging.  Warning: log levels are not set by --log_output_level until command is Run().
	Scope = log.RegisterScope("cli", "istioctl")
)

  istioctl validate -f samples/bookinfo/networking

  # Validate current deployments under 'default' namespace within the cluster
  kubectl get deployments -o yaml | istioctl validate -f -

  # Validate current services under 'default' namespace within the cluster
  kubectl get services -o yaml | istioctl validate -f -

  # Also see the related command 'istioctl analyze'

func NewAnalyzer(envoyConfig *configdump.Wrapper) (*Analyzer, error) {
	listeners, err := envoyConfig.GetDynamicListenerDump(true)
	if err != nil {
		return nil, fmt.Errorf("failed to get dynamic listener dump: %s", err)
	}

	return &Analyzer{listenerDump: listeners}, nil
}

// Print print the analysis results.
func (a *Analyzer) Print(writer io.Writer) {
	var listeners []*listener.Listener

	path := "config_dump"
	if eds {
		path += "?include_eds=true"
	}
	debug, err := kubeClient.EnvoyDoWithPort(context.TODO(), podName, podNamespace, "GET", path, proxyAdminPort)
	if err != nil {
		return nil, fmt.Errorf("failed to execute command on %s.%s sidecar: %v", podName, podNamespace, err)
	}
	return debug, err
}

	systemRoots, err := x509.SystemCertPool()
	if err != nil {
		return nil, fmt.Errorf("failed to get system cert pool: %w", err)
	}
	gcpCreds, err := oauth.NewApplicationDefault(ctx)
	if err != nil {
		return nil, fmt.Errorf("failed to get application default credentials: %w", err)
	}

	return []grpc.DialOption{
		grpc.WithTransportCredentials(credentials.NewTLS(&tls.Config{

	if err != nil {
		return fmt.Errorf("generate config: %v", err)
	}

	profile, ns, enabledComponents, err := getProfileNSAndEnabledComponents(iop)
	if err != nil {
		return fmt.Errorf("failed to get profile, namespace or enabled components: %v", err)
	}

	// Ignore the err because we don't want to show
	// "no running Istio pods in istio-system" for the first time

	}
	return nil
}

func getHTTPConnectionManager(filter *listener.Filter) *hcm.HttpConnectionManager {
	cm := &hcm.HttpConnectionManager{}
	if err := getFilterConfig(filter, cm); err != nil {
		log.Errorf("failed to get HTTP connection manager config: %s", err)
		return nil
	}
	return cm
}

func getHTTPFilterConfig(filter *hcm.HttpFilter, out proto.Message) error {
	switch c := filter.ConfigType.(type) {