DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE

DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE

}

func mcpTransport(ctx context.Context, tr http.RoundTripper) (http.RoundTripper, error) {
	creds, err := google.FindDefaultCredentials(ctx, "https://www.googleapis.com/auth/cloud-platform")
	if err != nil {
		return nil, fmt.Errorf("finding default GCP credentials: %w", err)
	}
	return &oauth2.Transport{
		Base:   tr,
		Source: creds.TokenSource,
	}, nil

# WARNING: DO NOT EDIT, THIS FILE IS A COPY.
# The original version of this file is located at /manifests/helm-profiles directory.
# If you want to make a change in this file, edit the original one and run "make gen".

# The demo profile enables a variety of things to try out Istio in non-production environments.
# * Lower resource utilization.
# * Some additional features are enabled by default; especially ones used in some tasks in istio.io.

						Pipe: &core.Pipe{Path: "unix:///dev/shm/uds.socket"},
					},
				},
			},
			expect: true,
		},
	}

	for _, tt := range tests {
		t.Run(tt.desc, func(t *testing.T) {
			if got := tt.inFilter.Verify(tt.inListener); got != tt.expect {
				t.Errorf("%s: expect %v got %v", tt.desc, tt.expect, got)
			}
		})
	}

			} else if filter.Name == TCPListener {
				if !strings.Contains(string(filter.GetTypedConfig().GetValue()), util.BlackHoleCluster) {
					nTCP++
				}
			}
		}
	}

	if nHTTP > 0 {
		if nTCP == 0 {
			return "HTTP"
		}
		return "HTTP+TCP"
	} else if nTCP > 0 {
		return "TCP"
	}

	return "UNKNOWN"
}

func retrieveListenerAddress(l *listener.Listener) string {

) (map[string]*discovery.DiscoveryResponse, error) {
	// If Central Istiod case, just call it
	if ns == "" {
		ns = istioNamespace
	}
	if ns == istioNamespace {
		serviceAccount = tokenServiceAccount
	}
	if centralOpts.Xds != "" {
		dialOpts, err := xds.DialOptions(centralOpts, ns, serviceAccount, kubeClient)
		if err != nil {
			return nil, err
		}

					v, ok := podLabels[me.Key]
					if !ok {
						continue
					}
					for _, nv := range me.Values {
						if nv == v {
							return fmt.Sprintf("Pod has %s=%s label, preventing injection", me.Key, v), false
						}
					}
				}
			}
		} else if podMatched {
			if v, ok := nsLabels[analyzer_util.InjectionLabelName]; ok {
				if v != "enabled" {

        runAsUser: 1337
        runAsGroup: 1337
{{- end }}
        runAsNonRoot: true
{{- end }}
      serviceAccountName: {{ $gateway.name }}-service-account
{{- if .Values.global.priorityClassName }}
      priorityClassName: "{{ .Values.global.priorityClassName }}"
{{- end }}
{{- if .Values.global.proxy.enableCoreDump }}
      initContainers:
        - name: enable-core-dump

	Namespace string
}

// Verify returns true if the passed workload matches the filter fields
func (wf *WorkloadFilter) Verify(workload *ZtunnelWorkload) bool {
	if wf.Address == "" && wf.Node == "" && wf.Namespace == "" {
		return true
	}

	if wf.Namespace != "" {
		if !strings.EqualFold(workload.Namespace, wf.Namespace) {
			return false
		}
	}

	if wf.Address != "" {
		var find bool