// +optional
  optional bytes patch = 4;

  // The type of Patch. Currently we only allow "JSONPatch".
  // +optional
  optional string patchType = 5;

  // AuditAnnotations is an unstructured key value map set by remote admission controller (e.g. error=image-blacklisted).
  // MutatingAdmissionWebhook and ValidatingAdmissionWebhook admission controller will prefix the keys with

			}

			if gw.Labels == nil {
				gw.Labels = map[string]string{}
			}

			gw.Labels[constants.AmbientWaypointForTrafficTypeLabel] = trafficType
		}

		if revision != "" {
			gw.Labels = map[string]string{label.IoIstioRev.Name: revision}
		}
		return &gw, nil
	}
	waypointGenerateCmd := &cobra.Command{
		Use:   "generate",

			return nil
		},
		RunE: func(cmd *cobra.Command, args []string) error {
			kubeClient, err := ctx.CLIClient()
			if err != nil {
				return err
			}
			var podName, podNs string
			var podLabels, nsLabels map[string]string
			if len(args) == 1 {
				podName, podNs, err = ctx.InferPodInfoFromTypedResource(args[0], ctx.Namespace())
				if err != nil {
					return err
				}

	}
	fmt.Fprintln(c.Stdout, string(out))
	return nil
}

func (c *ConfigWriter) PrintConnectionsSummary(filter ConnectionsFilter) error {
	w := c.tabwriter()
	d := c.ztunnelDump
	serviceNames := map[string]string{}
	workloadNames := map[string]string{}
	for netIP, s := range d.Services {
		_, ip, _ := strings.Cut(netIP, "/")
		serviceNames[ip] = s.Hostname
	}
	for netIP, s := range d.Workloads {
		_, ip, _ := strings.Cut(netIP, "/")

	cfg          config.RepairConfig
	events       kclient.EventRecorder
	repairedPods map[types.NamespacedName]types.UID
}

func NewRepairController(client kube.Client, cfg config.RepairConfig) (*Controller, error) {
	c := &Controller{
		cfg:          cfg,
		client:       client,
		events:       kclient.NewEventRecorder(client, "cni-repair"),
		repairedPods: map[types.NamespacedName]types.UID{},
	}
	fieldSelectors := []string{}

// Formatting options for Messages
const (
	LogFormat  = "log"
	JSONFormat = "json"
	YAMLFormat = "yaml"
)

var (
	MsgOutputFormatKeys = []string{LogFormat, JSONFormat, YAMLFormat}
	MsgOutputFormats    = make(map[string]bool)
	termEnvVar          = env.Register("TERM", "", "Specifies terminal type.  Use 'dumb' to suppress color output")
)

func init() {
	for _, key := range MsgOutputFormatKeys {
		MsgOutputFormats[key] = true
	}

	envoy, istiod *configdump.Wrapper
	w             io.Writer
	context       int
	location      string
}

// NewComparator is a comparator constructor
func NewComparator(w io.Writer, istiodResponses map[string][]byte, envoyResponse []byte) (*Comparator, error) {
	c := &Comparator{}
	for _, resp := range istiodResponses {
		istiodDump := &configdump.Wrapper{}
		err := json.Unmarshal(resp, istiodDump)
		if err != nil {

	return nil
}

func waypointName(wl *ZtunnelWorkload, services map[string]*ZtunnelService) string {
	if wl.Waypoint == nil {
		return "None"
	}

	if svc, ok := services[wl.Waypoint.Destination]; ok {
		return svc.Name
	}

	return "NA" // Shouldn't normally reach here
}

func serviceWaypointName(svc *ZtunnelService, services map[string]*ZtunnelService) string {
	if svc.Waypoint == nil {
		return "None"

// encode objects to when persisting objects in the backend.
message StorageVersionStatus {
  // The reported versions per API server instance.
  // +optional
  // +listType=map
  // +listMapKey=apiServerID
  repeated ServerStorageVersion storageVersions = 1;

  // If all API server instances agree on the same encoding storage version,

	sidecarInterceptModeKey = annotation.SidecarInterceptionMode.Name
	sidecarPortListKey      = annotation.SidecarStatusPort.Name

	kubevirtInterfacesKey = annotation.SidecarTrafficKubevirtInterfaces.Name

	annotationRegistry = map[string]*annotationParam{
		"inject":               {injectAnnotationKey, "", alwaysValidFunc},
		"status":               {sidecarStatusKey, "", alwaysValidFunc},