// SideEffects states whether this webhook has side effects.
  // Acceptable values are: None, NoneOnDryRun (webhooks created via v1beta1 may also specify Some or Unknown).
  // Webhooks with side effects MUST implement a reconciliation system, since a request may be
  // rejected by a future step in the admission chain and the side effects therefore need to be undone.

  // SideEffects states whether this webhook has side effects.
  // Acceptable values are: Unknown, None, Some, NoneOnDryRun
  // Webhooks with side effects MUST implement a reconciliation system, since a request may be
  // rejected by a future step in the admission chain and the side effects therefore need to be undone.

ection: disabled sidecar.istio.io/inject: "false" {{ with .Values.podAnnotations -}}{{ toYaml . | indent 8 }}{{ end }} spec: nodeSelector: kubernetes.io/os: linux serviceAccountName: ztunnel tolerations: - effect: NoSchedule operator: Exists - key: CriticalAddonsOnly operator: Exists - effect: NoExecute operator: Exists containers: - name: istio-proxy {{- if contains "/" .Values.image }} image: "{{ .Values.image }}" {{- else }} image: "{{ .Values.hub }}/{{ .Values.image | default "ztunnel" }}:{{...

**Please provide a description of this PR:**



**To help us figure out who should review this PR, please put an X in all the areas that this PR affects.**

- [ ] Ambient
- [ ] Configuration Infrastructure
- [ ] Docs
- [ ] Dual Stack
- [ ] Installation
- [ ] Networking
- [ ] Performance and Scalability
- [ ] Policies and Telemetry
- [ ] Security
- [ ] Test and Release
- [ ] User Experience
- [ ] Developer Infrastructure

# limitations under the License.

.DEFAULT_GOAL := default

# This repository has been enabled for BUILD_WITH_CONTAINER=1. Some
# test cases fail within Docker, and Mac + Docker isn't quite perfect.
# For more information see: https://github.com/istio/istio/pull/19322/

BUILD_WITH_CONTAINER ?= 1
CONTAINER_OPTIONS = --mount type=bind,source=/tmp,destination=/tmp --net=host

			expected: "example.com, www.example.com + 1 more...",
		},
	}

	for _, tt := range tests {
		t.Run(tt.desc, func(t *testing.T) {
			if got := describeRouteDomains(tt.domains); got != tt.expected {
				t.Errorf("%s: expect %v got %v", tt.desc, tt.expected, got)
			}
		})
	}
}

func TestPrintRoutesSummary(t *testing.T) {
	tests := []struct {
		name string
	}{
		{
			name: "empty-gateway",
		},
		{

  // If this field is not specified, it will default based on the existence of ingress or egress rules;
  // policies that contain an egress section are assumed to affect egress, and all policies
  // (whether or not they contain an ingress section) are assumed to affect ingress.
  // If you want to write an egress-only policy, you must explicitly specify policyTypes [ "Egress" ].

			// If oldpod != ready && newpod != ready, but the ambient annotation was added,
			// then assume this event was generated by the CNI plugin labeling the pod on startup,
			// and skip the event.
			//
			// This isn't perfect (someone could manually annotate an unready pod,
			// then install Istio, then the pod goes ready, and we'd miss capture) - but that
			// seems vanishingly unlikely
			wasReady := kube.CheckPodReadyOrComplete(oldPod)

				K8sServicePort:     c.k8sServicePort,
				SkipTLSVerify:      c.skipTLSVerify,
			}
			result, err := createKubeConfig(cfg)
			if err != nil {
				if !c.expectedFailure {
					t.Fatalf("did not expect failure: %v", err)
				}
				// Successful test case expecting failure
				return
			} else if c.expectedFailure {
				t.Fatalf("expected failure")
			}

			goldenFilepath := "testdata/kubeconfig-tls"

// See the License for the specific language governing permissions and
// limitations under the License.

package plugin

import (
	"fmt"
	"net/http"
	"net/http/httptest"
	"reflect"
	"testing"

	"github.com/containernetworking/cni/pkg/skel"
	corev1 "k8s.io/api/core/v1"
	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
	"k8s.io/apimachinery/pkg/runtime"

	"istio.io/api/annotation"