if err != nil {
				log.Fatalf("Cannot read generated IPTables rule file: %v", err)
			}
			generatedRules := getRules(generated)

			refreshGoldens(t, tt.golden, generatedRules)

			// Compare generated iptables rule with golden files.
			golden, err := os.ReadFile(tt.golden)
			if err != nil {
				log.Fatalf("Cannot read golden rule file: %v", err)
			}
			goldenRules := getRules(golden)

type: array type: object type: array tls: description: An ordered list of route rule for non-terminated TLS & HTTPS traffic. items: properties: match: description: Match conditions to be satisfied for the rule to be activated. items: properties: destinationSubnets: description: IPv4 or IPv6 ip addresses of destination with optional subnet. items: type: string type: array gateways: description: Names of gateways where the rule should be applied. items: type: string type: array port: description: Specifies...

	sed -e '1 i {{- if .Values.global.configCluster }}' -e '$$ a {{- end }}' manifests/charts/istio-control/istio-discovery/templates/role.yaml > manifests/charts/istiod-remote/templates/role.yaml
	sed -e '1 i {{- if .Values.global.configCluster }}' -e '$$ a {{- end }}' manifests/charts/istio-control/istio-discovery/templates/rolebinding.yaml > manifests/charts/istiod-remote/templates/rolebinding.yaml

  // `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]` and `matchPolicy: Equivalent`,
  // an API request to apps/v1beta1 deployments would be converted and sent to the webhook
  // with `kind: {group:"apps", version:"v1", kind:"Deployment"}` (matching the rule the webhook registered for),

Envoy Version:       0.0.0

NAME                                                                SERVICE FQDN                          PORT     SUBSET     DIRECTION       TYPE       DESTINATION RULE
cluster/agent                                                       cluster/agent                         -        -          -               STATIC     

  // `rules` describes which requests will match this flow schema. This FlowSchema matches a request if and only if
  // at least one member of rules matches the request.
  // if it is an empty slice, there will be no requests matching the FlowSchema.
  // +listType=atomic
  // +optional
  repeated PolicyRulesWithSubjects rules = 4;
}

  // `rules` describes which requests will match this flow schema. This FlowSchema matches a request if and only if
  // at least one member of rules matches the request.
  // if it is an empty slice, there will be no requests matching the FlowSchema.
  // +listType=atomic
  // +optional
  repeated PolicyRulesWithSubjects rules = 4;
}

	ss := re.FindStringSubmatch(path)
	if ss == nil {
		return "", "", fmt.Errorf("not a DR path: %s", path)
	}
	return ss[3], ss[2], nil
}

// getIstioDestinationRulePathForSvc returns something like "/apis/networking/v1alpha3/namespaces/default/destination-rule/reviews"

// superset of type `list:set` - we can then query the superset directly in iptables (with the same rule),
// and iptables will be smart enough to pick the correct underlying set (v4 or v6, based on context),
// reducing the # of rules we need.
//
// BUT netlink lib doesn't support adding things to `list:set` types yet, and current tagged release

               "rules": {
                "policies": {
                 "ns[default]-policy[httpbin]-rule[0]": {
                  "permissions": [
                   {
                    "and_rules": {
                     "rules": [
                      {
                       "or_rules": {
                        "rules": [
                         {