Xiaopeng Han <******@****.***> 1704323286 +0800

The command also supports reading from a standalone config dump file with flag -f.`,
		Example: `  # Check AuthorizationPolicy applied to pod httpbin-88ddbcfdd-nt5jb:
  istioctl x authz check httpbin-88ddbcfdd-nt5jb

  # Check AuthorizationPolicy applied to one pod under a deployment
  istioctl x authz check deployment/productpage-v1

  # Check AuthorizationPolicy from Envoy config dump file:
  istioctl x authz check -f httpbin_config_dump.json`,

	extapi "github.com/envoyproxy/go-control-plane/envoy/extensions/transport_sockets/tls/v3"
	anypb "google.golang.org/protobuf/types/known/anypb"
)

// GetSecretConfigDump retrieves a secret dump from a config dump wrapper
func (w *Wrapper) GetSecretConfigDump() (*admin.SecretsConfigDump, error) {
	secretDumpAny, err := w.getSection(secrets)
	if err != nil {
		return nil, err
	}
	secretDump := &admin.SecretsConfigDump{}

			expectedString:   `config dump has no configuration type`,
			wantException:    true,
		},
		{ // supplying valid pod name retrieves Envoy config (fails because we don't check in Envoy config unit tests)
			execClientConfig: loggingConfig,
			args:             strings.Split("bootstrap httpbin-794b576b6c-qx6pf", " "),
			expectedString:   `config dump has no configuration type`,
			wantException:    true,
		},

func (r *RouteFilter) Verify(route *route.RouteConfiguration) bool {
	if r.Name != "" && r.Name != route.Name {
		return false
	}
	return true
}

// PrintRouteSummary prints a summary of the relevant routes in the config dump to the ConfigWriter stdout
func (c *ConfigWriter) PrintRouteSummary(filter RouteFilter) error {
	w, routes, err := c.setupRouteConfigWriter()
	if err != nil {
		return err
	}
	if filter.Verbose {

)

// GetEcdsConfigDump retrieves the extension config dump from the ConfigDump
func (w *Wrapper) GetEcdsConfigDump() (*admin.EcdsConfigDump, error) {
	ecdsDumpAny, err := w.getSections(ecds)
	if err != nil {
		return nil, err
	}

	ecdsDump := &admin.EcdsConfigDump{}
	for _, dump := range ecdsDumpAny {
		ecds := &admin.EcdsConfigDump{}
		err = dump.UnmarshalTo(ecds)
		if err != nil {
			return nil, err
		}

  # Retrieve full workload dump of workloads with address XXXX for a given Ztunnel instance.
  istioctl x ztunnel-config workload <ztunnel-name[.namespace]> --address 0.0.0.0 -o json

  # Retrieve Ztunnel config dump separately and inspect from file.
  kubectl exec -it $ZTUNNEL -n istio-system -- curl localhost:15000/config_dump > ztunnel-config.json

// limitations under the License.

package configdump

import (
	admin "github.com/envoyproxy/go-control-plane/envoy/admin/v3"
)

// GetEndpointsConfigDump retrieves the listener config dump from the ConfigDump
func (w *Wrapper) GetEndpointsConfigDump() (*admin.EndpointsConfigDump, error) {
	endpointsDumpAny, err := w.getSection(endpoints)
	if err != nil {
		return nil, nil
	}

	"istio.io/istio/istioctl/pkg/util/testutil"
)

func TestAuthz(t *testing.T) {
	cases := []testutil.TestCase{
		{
			Args:           []string{"-f fake.yaml"},
			ExpectedOutput: "Error: failed to get config dump from file  fake.yaml: open  fake.yaml: no such file or directory\n",
			WantException:  true,
		},
		{
			Args: []string{"-f", "testdata/configdump.yaml"},
			ExpectedOutput: `ACTION   AuthorizationPolicy         RULES

package configdump

import (
	"bytes"
	"io"
	"os"
	"testing"

	"istio.io/istio/pkg/test/util/assert"
)

func TestSDSWriter_ValidCert(t *testing.T) {
	configDumpFile, err := os.Open("testdata/secret/config_dump.json")
	if err != nil {
		t.Errorf("error opening test data file: %v", err)
	}
	defer configDumpFile.Close()
	configDump, err := io.ReadAll(configDumpFile)
	if err != nil {