default            sleep-7656cf8794-lxcmx                               10.244.2.58 ambient-worker2       None                                HBONE
gateway-system     gateway-api-admission-server-85985d48ff-5jcvd        10.244.2.8  ambient-worker2       None                                TCP

}

func (mrdir *mockInterceptRuleMgr) Program(podName, netns string, redirect *Redirect) error {
	mrdir.lastRedirect = append(mrdir.lastRedirect, redirect)
	return nil
}

// returns the test server URL and a dispose func for the test server
func setupCNIEventClientWithMockServer(serverErr bool) (string, func() bool) {
	cniAddServerCalled := false
	// replace the global CNI client with mock

                        "http2_protocol_options": {
                          "max_concurrent_streams": 100,
                          "allow_connect": true
                        },
                        "server_name": "istio-envoy",
                        "forward_client_cert_details": "APPEND_FORWARD",
                        "set_current_client_cert_details": {
                          "subject": true,

  # Retrieve Envoy server metrics in prometheus format
  istioctl experimental envoy-stats <pod-name[.namespace]> --output prom

  # Retrieve Envoy server metrics in prometheus format with custom proxy admin port
  istioctl experimental envoy-stats <pod-name[.namespace]> --output prom --proxy-admin-port 15000

  # Retrieve Envoy server metrics in prometheus format with merged application metrics

      return 1
      ;;
  esac

  # If metrics server configuration directory is specified then deploy in
  # the cluster just created
  if [[ -n ${METRICS_SERVER_CONFIG_DIR:-} ]]; then
    retry kubectl apply -f "${METRICS_SERVER_CONFIG_DIR}"
  fi

  # Install Metallb if not set to install explicitly
  if [[ -z "${NOMETALBINSTALL}" ]]; then

      "name": "gateway-api-admission-server-85985d48ff-5jcvd",
      "namespace": "gateway-system",
      "trustDomain": "cluster.local",
      "serviceAccount": "default",
      "workloadName": "gateway-api-admission-server",
      "workloadType": "deployment",
      "canonicalName": "gateway-api-admission-server",
      "canonicalRevision": "latest",

      # JWT is intended for the CA.
      token:
        aud: istio-ca

    sts:
      # The service port used by Security Token Service (STS) server to handle token exchange requests.
      # Setting this port to a non-zero value enables STS server.
      servicePort: 0

    # The name of the CA for workload certificates.
    # For example, when caName=GkeWorkloadCertificate, GKE workload certificates

  // +optional
  optional string requestSubResource = 15;

  // Name is the name of the object as presented in the request.  On a CREATE operation, the client may omit name and
  // rely on the server to generate the name.  If that is the case, this field will contain an empty string.
  // +optional
  optional string name = 5;

  // Namespace is the namespace associated with the request (if any).
  // +optional

  // selector is the string-encoded form of a standard kubernetes label selector for the given metric
  // When set, it is passed as an additional parameter to the metrics server for more specific metrics scoping
  // When unset, just the metricName will be used to gather metrics.
  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.LabelSelector selector = 4;

  # Retrieve syncz debug information directly from the control plane, using RSA certificate security
  # (Certificates must be obtained before this step.  The --cert-dir flag lets istioctl bypass the Kubernetes API server.)
  istioctl x internal-debug syncz --xds-address istio.example.com:15012 --cert-dir ~/.istio-certs

  # Retrieve syncz information via XDS from specific control plane in multi-control plane in-cluster configuration