if err != nil {
		return nil, fmt.Errorf("error while listing mutating webhooks: %v", err)
	}
	for _, hook := range webhooks {
		rev := renderWithDefault(hook.GetLabels()[label.IoIstioRev.Name], DefaultRevisionName)
		tagLabel := hook.GetLabels()[label.IoIstioTag.Name]
		ri, revPresent := revisions[rev]
		if revPresent {
			if tagLabel != "" {
				ri.Webhooks = append(ri.Webhooks, &MutatingWebhookConfigInfo{
					Name:     hook.Name,

  // a network host (e.g. "foo.bar.com") or "wildcard", which is a domain name
  // prefixed with a single wildcard label (e.g. "*.foo.com").
  // The wildcard character '*' must appear by itself as the first DNS label and
  // matches only a single label. You cannot have a wildcard label by itself (e.g. Host == "*").
  // Requests will be matched against the Host field in the following way:

	SUBQ R11, 8(R12)
	SUBQ R11, foo+4(SB)

// LTYPE4 remrim	{ outcode($1, &$2); }
	CMPB	CX, $4

// LTYPER nonrel	{ outcode($1, &$2); }
label:
	JB	-4(PC) // JCS -4(PC)
	JB	label // JCS 17

// LTYPEC spec3	{ outcode($1, &$2); }
	JCS	2(PC)
	JMP	-4(PC)
	JCS	2(PC)
	JMP	label // JMP 17
	JCS	2(PC)
	JMP	foo+4(SB)
	JCS	2(PC)
	JMP	bar<>+4(SB)
	JCS	2(PC)
	JMP	bar<>+4(SB)(R11*4)
	JCS	2(PC)

                                                                                data-dismiss="modal"
                                                                                aria-label="Close">
                                                                            <span aria-hidden="true">×</span>
                                                                        </button>

        run: |
          echo "DATE=$(date +'%Y-%m-%d')" >> "$GITHUB_OUTPUT"
        id: date
      -
        name: Build containers, and push to GCR only if the 'build and push to gcr.io for staging' label is applied
        id: docker_build
        uses: docker/build-push-action@4f58ea79222b3b9dc2c8bbdd6debcef730109a75 # v6.9.0
        with:

	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
	"k8s.io/cli-runtime/pkg/resource"
	"k8s.io/client-go/rest/fake"
	cmdtesting "k8s.io/kubectl/pkg/cmd/testing"
	cmdutil "k8s.io/kubectl/pkg/cmd/util"

	"istio.io/api/label"
	"istio.io/istio/istioctl/pkg/cli"
	"istio.io/istio/istioctl/pkg/clioptions"
	"istio.io/istio/istioctl/pkg/multixds"
	"istio.io/istio/istioctl/pkg/xds"
	"istio.io/istio/pkg/kube"
	"istio.io/istio/pkg/test/util/assert"

                                                     styleClass="form-inline">
                                                <label for="bulkFile" class="mb-2 mr-2"><la:message
                                                        key="labels.backup_bulk_file"/></label>
                                                <div class="mb-2 mr-sm-2"><input type="file" id="bulkFile"

  // a network host (e.g. "foo.bar.com") or "wildcard", which is a domain name
  // prefixed with a single wildcard label (e.g. "*.foo.com").
  // The wildcard character '*' must appear by itself as the first DNS label and
  // matches only a single label. You cannot have a wildcard label by itself (e.g. Host == "*").
  // Requests will be matched against the Host field in the following way:

		l[i], l[j] = l[j], l[i]
	}
	return path.Join(append([]string{etcdPathSeparator + prefix + etcdPathSeparator}, l...)...)
}

// dnsJoin joins labels to form a fully qualified domain name. If the last label is
// the root label it is ignored. Not other syntax checks are performed.
func dnsJoin(labels ...string) string {
	ll := len(labels)
	if labels[ll-1] == "." {
		return strings.Join(labels[:ll-1], ".") + "."
	}

labels.webauth_scheme_ntlm=NTLM
labels.webauth_scheme_form=Form
labels.log_configuration=Log Files
labels.log_file_name=File Name
labels.log_file_date=Timestamp
labels.labeltype_configuration=Label
labels.labeltype_title_details=Label
labels.labeltype_name=Name
labels.labeltype_value=Value
labels.labeltype_included_paths=Included Paths
labels.labeltype_excluded_paths=Excluded Paths
labels.roletype_configuration=Role