"istio.io/istio/pkg/bootstrap"
	"istio.io/istio/pkg/model"
	"istio.io/istio/pkg/util/istiomultierror"
)

var (
	allowHTTPTypedConfig = &anypb.Any{
		TypeUrl: "type.googleapis.com/envoy.extensions.filters.http.rbac.v3.RBAC",
	}
	allowNetworkTypedConfig = &anypb.Any{
		TypeUrl: "type.googleapis.com/envoy.extensions.filters.network.rbac.v3.RBAC",
	}
)

func createHTTPAllowAllFilter(name string) (*anypb.Any, error) {

			if err != nil {
				return nil, err
			}
			return &clientCert, nil
		}
	}

	return nil
}

func convertTypeURLToMCPGVK(typeURL string) (config.GroupVersionKind, bool) {
	parts := strings.SplitN(typeURL, "/", 3)
	if len(parts) != 3 {
		return config.GroupVersionKind{}, false
	}

	gvk := config.GroupVersionKind{
		Group:   parts[0],
		Version: parts[1],
		Kind:    parts[2],

apiVersion: release-notes/v2
kind: feature
area: traffic-management
issue: [22274]
releaseNotes:
- |
  **Added** The Istio sidecar agent will offer HTTP endpoint localhost:15009/debug/<typeurl>.  GET requests
  to that URL will be resolved by sending an xDS discovery "event" to istiod.  This can be disabled by setting

	// Another removal should behave the same
	s.MemRegistry.RemoveService("eds.test.svc.cluster.local")
	resp = ads.ExpectResponse()
	// ACK
	ads.Request(&discovery.DeltaDiscoveryRequest{
		TypeUrl:       resp.TypeUrl,
		ResponseNonce: resp.Nonce,
	})
	assertResources(resp)
	assert.Equal(t, resp.RemovedResources, []string{"outbound|8080||eds.test.svc.cluster.local"})

	// Another removal should behave the same

				// If we did not do this, merge.Merge below will panic (which is recovered), so even though this
				// is not 100% reliable its better than doing nothing
				if userFilter.GetTypedConfig().TypeUrl != filter.GetTypedConfig().TypeUrl {
					userFilter.ConfigType.(*listener.Filter_TypedConfig).TypedConfig.TypeUrl = filter.GetTypedConfig().TypeUrl
				}

	return func() (*istioVersion.MeshInfo, error) {
		xdsRequest := discovery.DiscoveryRequest{
			TypeUrl: xds.TypeDebugSyncronization,
		}
		kubeClient, err := ctx.CLIClientWithRevision(opts.Revision)
		if err != nil {
			return nil, err
		}

func (w *Watch) GetWatchedResource(string) *xds.WatchedResource {
	w.Lock()
	defer w.Unlock()
	return w.watch
}

func (w *Watch) NewWatchedResource(typeURL string, names []string) {
	w.Lock()
	defer w.Unlock()
	w.watch = &xds.WatchedResource{TypeUrl: typeURL, ResourceNames: names}
}

func (w *Watch) UpdateWatchedResource(_ string, f func(*xds.WatchedResource) *xds.WatchedResource) {
	w.Lock()
	defer w.Unlock()

	for _, l := range a.listenerDump.DynamicListeners {
		listenerTyped := &listener.Listener{}
		// Support v2 or v3 in config dump. See ads.go:RequestedTypes for more info.
		l.ActiveState.Listener.TypeUrl = v3.ListenerType
		err := l.ActiveState.Listener.UnmarshalTo(listenerTyped)
		if err != nil {
			return
		}
		listeners = append(listeners, listenerTyped)
	}
	Print(writer, listeners)

	timeout := time.Second * 15
	req, err := downstream.Recv()
	if err != nil {
		log.Errorf("failed to recv: %v", err)
		return err
	}
	if strings.HasPrefix(req.TypeUrl, TypeDebugPrefix) {
		if resp, err := p.xdsProxy.tapRequest(req, timeout); err == nil {
			err := downstream.Send(resp)
			if err != nil {
				log.Errorf("failed to send: %v", err)
				return err
			}
		} else {

}

func (sg *StatusGen) handleInternalRequest(_ *model.Proxy, w *model.WatchedResource, _ *model.PushRequest) (model.Resources, model.XdsLogDetails, error) {
	res := model.Resources{}

	switch w.TypeUrl {
	case TypeDebugSyncronization:
		res = sg.debugSyncz()
	case TypeDebugConfigDump:
		if len(w.ResourceNames) == 0 || len(w.ResourceNames) > 1 {
			// Malformed request from client