RedirectDNS:   c.RedirectDNS,
	}
}

func NewIptablesConfigurator(cfg *Config, ext dep.Dependencies, nlDeps NetlinkDependencies) (*IptablesConfigurator, error) {
	if cfg == nil {
		cfg = &Config{
			RestoreFormat: true,
		}
	}

	configurator := &IptablesConfigurator{
		ext:    ext,
		nlDeps: nlDeps,
		cfg:    cfg,
	}

	// By detecting iptables versions *here* once-for-all we are

			MonitoringPort:     0,
			LogUDSAddress:      "",
			CNINetworkConfig:   cniNetworkConfig,
			KubeconfigFilename: "ZZZ-istio-cni-kubeconfig",
			CNINetDir:          "/etc/cni/net.d",
			ChainedCNIPlugin:   true,
			LogLevel:           "debug",
			KubeconfigMode:     constants.DefaultKubeconfigMode,
		},
	}

	if cniConfFileName != "" {
		installConfig.InstallConfig.CNIConfName = cniConfFileName
	}

	viper.SetDefault("xds-port", 15012)
}

// GetRootCmd returns the root of the cobra command-tree.
func GetRootCmd(args []string) *cobra.Command {
	rootCmd := &cobra.Command{
		Use:               "istioctl",
		Short:             "Istio control interface.",
		SilenceUsage:      true,
		DisableAutoGenTag: true,
		PersistentPreRunE: ConfigureLogging,
		Long: `Istio configuration command line utility for service operators to

	if err := parent.Execute(); err != nil {
		t.Fatal(err)
	}
	got := out.String()
	out.Reset()
	checkHelpForFlag(t, got, parentFlag0, true)
	checkHelpForFlag(t, got, parentFlag1, true)
	checkHelpForFlag(t, got, parentFlag2, true)
	checkHelpForFlag(t, got, childFlag2, true)

	// verify the hidden parent flag is not visible in help text
	hideInheritedFlags(child, parentFlag1, parentFlag2)

	}{
		{
			name:             "returns expected secret summary onto Stdout",
			callPrime:        true,
			wantOutputSecret: "testdata/secretsummary.txt",
		},
		{
			name:    "errors if config dump is not primed",
			wantErr: true,
		},
		{
			name:               "returns expected workload summary onto Stdout",
			callPrime:          true,
			wantOutputWorkload: "testdata/workloadsummary.txt",
		},
		{

			args: args{
				namespace: namespaceWithAmbientEnabledLabel,
				pod:       unlabelledPod,
			},
			want: true,
		},
		{
			name: "ambient mode enabled for pod",
			args: args{
				namespace: unlabelledNamespace,
				pod:       podWithAmbientEnabledLabel,
			},
			want: true,
		},
		{
			name: "ambient mode enabled for both namespace and pod",
			args: args{

	Port      int
	Subset    string
	Direction model.TrafficDirection
}

// Verify returns true if the passed cluster matches the filter fields
func (c *ClusterFilter) Verify(cluster *cluster.Cluster) bool {
	name := cluster.Name
	if c.FQDN == "" && c.Port == 0 && c.Subset == "" && c.Direction == "" {
		return true
	}
	if c.FQDN != "" && !strings.Contains(name, string(c.FQDN)) {
		return false
	}

				continue
			}
			isDir = fi.IsDir()
		}

		if !isDir {
			processFile(filename)
			processedFiles[filename] = true
			continue
		}
		if err := processDirectory(filename, func(path string) {
			processFile(path)
			processedFiles[path] = true
		}); err != nil {
			errs = multierror.Append(errs, err)
		}
	}
	filenames = []string{}
	for p := range processedFiles {

					if err != nil {
						return err
					}
				} else {
					var err error
					configWriter, err = setupFileConfigdumpWriter(configDumpFile, c.OutOrStdout())
					if err != nil {
						return err
					}
				}
				configdump.SetPrintConfigTypeInSummary(true)
				sdscompare.SetPrintConfigTypeInSummary(true)
				return configWriter.PrintFullSummary(

	var family uint8

	if v6 {
		family = unix.AF_INET6
	} else {
		family = unix.AF_INET
	}
	err := netlink.IpsetCreate(name, "hash:ip", netlink.IpsetCreateOptions{Comments: true, Replace: true, Family: family})
	if ipsetErr, ok := err.(nl.IPSetError); ok && ipsetErr == nl.IPSET_ERR_EXIST {
		return nil
	}

	return err
}

func (m *realDeps) destroySet(name string) error {