ExpectedOutput string         // Expected constant output
	ExpectedRegexp *regexp.Regexp // Expected regexp output
	GoldenFilename string         // Expected output stored in golden file

	WantException bool
}

func VerifyOutput(t *testing.T, cmd *cobra.Command, c TestCase) {
	t.Helper()

	cmd.SetArgs(c.Args)

	var out bytes.Buffer
	cmd.SetOut(&out)
	cmd.SetErr(&out)
	cmd.SilenceUsage = true

  optional k8s.io.apimachinery.pkg.runtime.RawExtension oldObject = 10;

  // DryRun indicates that modifications will definitely not be persisted for this request.
  // Defaults to false.
  // +optional
  optional bool dryRun = 11;

  // Options is the operation option structure of the operation being performed.
  // e.g. `meta.k8s.io/v1.DeleteOptions` or `meta.k8s.io/v1.CreateOptions`. This may be

		err := config.GetEcdsFilter().UnmarshalTo(c)
		if err != nil {
			return nil, fmt.Errorf("failed to retrieve TypedExtensionConfig: %v", err)
		}

		ecds = append(ecds, c)
	}

	sort.Slice(ecds, func(i, j int) bool {
		if ecds[i].GetTypedConfig().GetTypeUrl() == ecds[j].GetTypedConfig().GetTypeUrl() {
			return ecds[i].GetName() < ecds[j].GetName()
		}

type ServiceFilter struct {
	Namespace string
}

// Verify returns true if the passed workload matches the filter fields
func (wf *ServiceFilter) Verify(svc *ZtunnelService) bool {
	if wf.Namespace != "" {
		if !strings.EqualFold(svc.Namespace, wf.Namespace) {
			return false
		}
	}

	return true
}

  // one PriorityClasses exists with their `globalDefault` field set to true,
  // the smallest value of such global default PriorityClasses will be used as the default priority.
  // +optional
  optional bool globalDefault = 3;

  // description is an arbitrary string that usually provides guidelines on
  // when this priority class should be used.
  // +optional
  optional string description = 4;

	tcs := []struct {
		name           string
		istioNamespace string
		webhook        admitv1.MutatingWebhookConfiguration
		whURL          string
		whSVC          string
		whCA           string
		userManaged    bool
	}{
		{
			name:           "webhook-pointing-to-service",
			istioNamespace: "istio-system",
			webhook:        revisionCanonicalWebhook,
			whURL:          "",
			whSVC:          "istiod-revision",

		//
		// Adds in-pod rules for marking packets with the istio-specific TPROXY mark.
		// A very similar mechanism is used for sidecar TPROXY.
		//
		// TODO largely identical/copied from tools/istio-iptables/pkg/capture/run_linux.go
		inpodMarkRule := netlink.NewRule()
		inpodMarkRule.Family = family
		inpodMarkRule.Table = RouteTableInbound
		inpodMarkRule.Mark = InpodTProxyMark

	"istio.io/istio/pkg/wellknown"
)

func TestListenerFilter_Verify(t *testing.T) {
	tests := []struct {
		desc       string
		inFilter   *ListenerFilter
		inListener *listener.Listener
		expect     bool
	}{
		{
			desc: "filter-fields-empty",
			inFilter: &ListenerFilter{
				Address: "",
				Port:    0,
				Type:    "",
			},
			inListener: &listener.Listener{},
			expect:     true,
		},
		{

// whether to make an installation the default.
func PreviousInstallExists(ctx context.Context, client kubernetes.Interface) bool {
	mwhs, err := client.AdmissionregistrationV1().MutatingWebhookConfigurations().List(ctx, metav1.ListOptions{
		LabelSelector: "app=sidecar-injector",
	})
	if err != nil {
		return false
	}

}

// TokenReviewStatus is the result of the token authentication request.
message TokenReviewStatus {
  // Authenticated indicates that the token was associated with a known user.
  // +optional
  optional bool authenticated = 1;

  // User is the UserInfo associated with the provided token.
  // +optional
  optional UserInfo user = 2;

  // Audiences are audience identifiers chosen by the authenticator that are