echo "Copying $(pwd)/${ZTUNNEL_BIN_PATH} to ${TARGET_OUT_LINUX}/ztunnel"
  mkdir -p "${TARGET_OUT_LINUX}"
  cp "${ZTUNNEL_BIN_PATH}" "${TARGET_OUT_LINUX}/ztunnel"
  popd
}

# ztunnel binary vars (TODO handle debug builds, arm, darwin etc.)
ISTIO_ZTUNNEL_BASE_URL="${ISTIO_ZTUNNEL_BASE_URL:-https://storage.googleapis.com/istio-build/ztunnel}"

            "items": {
              "default": "",
              "type": "string"
            },

              audience: istio-ca
      - name: istiod-ca-cert
        configMap:
          name: istio-ca-root-cert
      - name: cni-ztunnel-sock-dir
        hostPath:
          path: /var/run/ztunnel
          type: DirectoryOrCreate # ideally this would be a socket, but ztunnel may not have started yet.
      # pprof needs a writable /tmp, and we don't have that thanks to `readOnlyRootFilesystem: true`, so mount one

}

// Delete a workload from the ztunnel. Ztunnel should shutdown the workload's proxy.
message DelWorkload {
  string uid = 2;
}

// Let ztunnel know that a full snapshot was sent. Ztunnel should reconcile its internal state
// and remove internal entries that were not sent.
message SnapshotSent {
}

// Ztunnel ack message. If error is not empty, this is an error message.
message Ack {
  string error = 1;
}

/*

apiVersion: release-notes/v2
kind: feature
area: istioctl
issue:
  - 49841
releaseNotes:
- |
  **Added** Add ztunnel-config istioctl command. Allow users to view Ztunnel configuration information through istioctl via ztunnel-config workload flag. 

	} else {
		log.Infof("Namespace %s is disabled from ambient mesh", namespace)
	}
	for _, pod := range s.pods.List(namespace, klabels.Everything()) {
		// ztunnel pods are never "added to/removed from the mesh", so do not fire
		// spurious events for them to avoid triggering extra
		// ztunnel node reconciliation checks.
		if !util.IsZtunnelPod(s.systemNamespace, pod) {
			log.Debugf("Enqueuing pod %s/%s", pod.Namespace, pod.Name)

kind: ClusterRoleBinding
metadata:
  name: ztunnel
  labels:
    app: ztunnel
    release: {{ .Release.Name }}
    istio.io/rev: {{ .Values.revision | default "default" }}
    install.operator.istio.io/owning-resource: {{ .Values.ownerName | default "unknown" }}
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: ztunnel
subjects:
- kind: ServiceAccount
  name: ztunnel
  namespace: {{ .Release.Namespace }}

		validateField(t, "GolangVersion", verInfo.GolangVersion)
		validateField(t, "BuildStatus", verInfo.BuildStatus)
		validateField(t, "GitTag", verInfo.GitTag)
	})
}

var (
	nonGoBinaries      = sets.New("ztunnel", "envoy")
	nonVersionBinaries = sets.New("client", "server")
)

// Test that flags do not get polluted with unexpected flags
func TestFlags(t *testing.T) {
	runBinariesTest(t, func(t *testing.T, name string) {

			switch {
			case !errors.Is(err, os.ErrDeadlineExceeded):
				log.Debugf("ztunnel keepalive failed: %v", err)
				if errors.Is(err, io.EOF) {
					log.Debug("ztunnel EOF")
					return nil
				}
				return err
			case err == nil:
				log.Warn("ztunnel protocol error, unexpected message")
				return fmt.Errorf("ztunnel protocol error, unexpected message")
			default:

    meta -> app
    istio[label="istio/*"]
    meta -> istio
    cni[label="istio/cni.yaml"]
    istio -> cni
    cpt[label="istio/control-plane-appset.yaml"]
    istio -> cpt
    ztunnel[label="istio/ztunnel.yaml"]
    istio -> ztunnel
    extras[label="istio/extras.yaml"]
    istio -> extras
    tags[label="istio/tags.yaml"]
    istio -> tags
    fontsize="32"
    label = "ArgoCD Cluster";
  }