// delete the draining state for proper comparison
		l.DrainingState = nil
		if l.ActiveState != nil {
			dal = append(dal, l)
		}
	}

	// Support v2 or v3 in config dump. See ads.go:RequestedTypes for more info.
	for i := range dal {
		dal[i].ActiveState.Listener.TypeUrl = v3.ListenerType
	}
	sort.Slice(dal, func(i, j int) bool {
		l := &listener.Listener{}

// and iptables will be smart enough to pick the correct underlying set (v4 or v6, based on context),
// reducing the # of rules we need.
//
// BUT netlink lib doesn't support adding things to `list:set` types yet, and current tagged release
// doesn't support creating `list:set` types yet (is in main branch tho).
// So this will actually create 2 underlying ipsets, one for v4 and one for v6

		return nil, err
	}
	routes := make([]*route.RouteConfiguration, 0)
	for _, r := range routeDump.DynamicRouteConfigs {
		if r.RouteConfig != nil {
			routeTyped := &route.RouteConfiguration{}
			// Support v2 or v3 in config dump. See ads.go:RequestedTypes for more info.
			r.RouteConfig.TypeUrl = v3.RouteType
			err = r.RouteConfig.UnmarshalTo(routeTyped)
			if err != nil {
				return nil, err
			}

	}
	listeners, err := cd.GetListenerConfigDump()
	if err != nil {
		return nil, err
	}

	for _, l := range listeners.DynamicListeners {
		if l.ActiveState == nil {
			continue
		}
		// Support v2 or v3 in config dump. See ads.go:RequestedTypes for more info.
		l.ActiveState.Listener.TypeUrl = v3.ListenerType
		listenerTyped := &listener.Listener{}
		err = l.ActiveState.Listener.UnmarshalTo(listenerTyped)

		// Neither namespace nor pod has ambient mode enabled
		return false
	}
	if podHasSidecar(pod) {
		// Ztunnel and sidecar for a single pod is currently not supported; opt out.
		return false
	}
	if pod.GetLabels()[constants.DataplaneModeLabel] == constants.DataplaneModeNone {
		// Pod explicitly asked to not have ambient redirection enabled
		return false
	}
	return true
}

	if err != nil {
		return nil, nil, err
	}
	if err := k8sversion.IsK8VersionSupported(kubeClient, l); err != nil {
		return nil, nil, fmt.Errorf("check minimum supported Kubernetes version: %v", err)
	}
	return kubeClient, client, nil
}

// applyOptions contains the startup options for applying the manifest.
type applyOptions struct {
	// Path to the kubeconfig file.

			installLog.Error("error watching node CNI config")
			return err
		}
		installLog.Info("Detected changes to the node-level CNI setup, checking to see if configs or binaries need redeploying")
		// We don't support (or want) to silently (re)deploy any binaries that were not in the initial "snapshot"
		// so we intentionally discard/do not update the list of installedBins on redeploys.
		if _, err := in.installAll(ctx); err != nil {

			`<code>=<resource> (e.g. '--suppress "IST0102=DestinationRule primary-dr.default"'). Can be repeated. `+
			`You can include the wildcard character '*' to support a partial match (e.g. '--suppress "IST0102=DestinationRule *.default" ).`)
	analysisCmd.PersistentFlags().DurationVar(&analysisTimeout, "timeout", 30*time.Second,
		"The duration to wait before failing")

	UnSupportedK8SVersionLogMsg = "\nThe Kubernetes version %s is not supported by Istio %s. The minimum supported Kubernetes version is 1.%d.\n" +
		"Proceeding with the installation, but you might experience problems. " +
		"See https://istio.io/latest/docs/releases/supported-releases/ for a list of supported versions.\n"
)

// CheckKubernetesVersion checks if this Istio version is supported in the k8s version

			case summaryOutput:
				return cw.PrintSecretSummary()
			case jsonOutput, yamlOutput:
				return cw.PrintSecretDump(common.outputFormat)
			default:
				return fmt.Errorf("output format %q not supported", common.outputFormat)
			}
		}),
		ValidArgsFunction: completion.ValidPodsNameArgs(ctx),
	}

	common.attach(cmd)

	return cmd
}

func servicesCmd(ctx cli.Context) *cobra.Command {