// TODO this only makes sense in context of a chain... do we need a way to give it context
			return []string{"ANY"}, true
		}
	case *matcher.Matcher_OnMatch_Matcher:
		ms, f := recurse(name, v.Matcher)
		if !f {
			return []string{"NONE"}, true
		}
		return ms, true
	}
	// TODO support list
	n := match.GetMatcherTree().GetInput().GetName()

	var m map[string]*matcher.Matcher_OnMatch

	envoyClusterDump, err := c.envoy.GetDynamicClusterDump(true)
	if err != nil {
		envoyBytes.WriteString(err.Error())
	} else {
		envoy, err := protomarshal.ToJSONWithAnyResolver(envoyClusterDump, "    ", &envoyResolver)
		if err != nil {
			return err
		}
		envoyBytes.WriteString(envoy)
	}
	istiodClusterDump, err := c.istiod.GetDynamicClusterDump(true)
	if err != nil {
		istiodBytes.WriteString(err.Error())
	} else {

	envoyListenerDump, err := c.envoy.GetDynamicListenerDump(true)
	if err != nil {
		envoyBytes.WriteString(err.Error())
	} else {
		envoy, err := protomarshal.ToJSONWithAnyResolver(envoyListenerDump, "    ", &envoyResolver)
		if err != nil {
			return err
		}
		envoyBytes.WriteString(envoy)
	}
	istiodListenerDump, err := c.istiod.GetDynamicListenerDump(true)
	if err != nil {
		istiodBytes.WriteString(err.Error())
	} else {

	return l.HealthStatus.GetFailedOutlierCheck()
}

// Verify returns true if the passed host matches the filter fields
func (e *EndpointFilter) Verify(host *admin.HostStatus, cluster string) bool {
	if e.Address == "" && e.Port == 0 && e.Cluster == "" && e.Status == "" {
		return true
	}
	if e.Address != "" && !strings.EqualFold(retrieveEndpointAddress(host), e.Address) {
		return false
	}

	// This is only used in `proxy-status` command.
	XdsViaAgents bool

	// XdsViaAgentsLimit is the maximum number of pods being visited by istioctl,
	// when `XdsViaAgents` is true. This is only used in `proxy-status` command.
	// 0 means that there is no limit.
	XdsViaAgentsLimit int
}

var DefaultOptions = Options{
	MessageWriter:     os.Stdout,
	XdsViaAgents:      false,

	termEnvVar          = env.Register("TERM", "", "Specifies terminal type.  Use 'dumb' to suppress color output")
)

func init() {
	for _, key := range MsgOutputFormatKeys {
		MsgOutputFormats[key] = true
	}
}

// Print output messages in the specified format with color options
func Print(ms diag.Messages, format string, colorize bool) (string, error) {
	switch format {
	case LogFormat:

	}
	// use annotation value if present
	if val, found := annotations[annotationRegistry[name].key]; found {
		if err := annotationRegistry[name].validator(val); err != nil {
			return true, annotationRegistry[name].defaultVal, err
		}
		return true, val, nil
	}
	// no annotation found so use default value
	return false, annotationRegistry[name].defaultVal, nil
}

	if err != nil {
		return false, err
	}
	if diff != "" {
		fmt.Printf("Differences in manifests are:\n%s\n", diff)
		return false, nil
	}

	fmt.Println("Manifests are identical")
	return true, nil
}

func yamlFileFilter(path string) bool {
	return filepath.Ext(path) == YAMLSuffix
}

// compareManifestsFromDirs compares manifests from two directories

	cmdController cmdType = "operator controller"
)

// Golden output files add a lot of noise to pull requests. Use a unique suffix so
// we can hide them by default. This should match one of the `linuguist-generated=true`
// lines in istio.io/istio/.gitattributes.
const (
	goldenFileSuffixHideChangesInReview = ".golden.yaml"
	goldenFileSuffixShowChangesInReview = ".golden-show-in-gh-pull-request.yaml"
)

var (

	client, err := buildKubeClient(args.KubeConfig)
	if err != nil {
		return nil, fmt.Errorf("error initializing kube client: %w", err)
	}

	cfg := &iptables.Config{
		RestoreFormat: true,
		RedirectDNS:   args.DNSCapture,
		EnableIPv6:    args.EnableIPv6,
	}

	log.Debug("creating ipsets in the node netns")
	set, err := createHostsideProbeIpset(cfg.EnableIPv6)
	if err != nil {