}
	}

	return true
}

// PrintServiceSummary prints a summary of the relevant services in the config dump to the ConfigWriter stdout
func (c *ConfigWriter) PrintServiceSummary(filter ServiceFilter) error {
	w := c.tabwriter()
	zDump := c.ztunnelDump

	svcs := slices.Filter(maps.Values(zDump.Services), filter.Verify)
	slices.SortFunc(svcs, func(a, b *ZtunnelService) int {

	ProxyType         string
	ProxyEnvironments map[string]string
	ProxyUID          *int64
	ProxyGID          *int64
}

// newK8sClient returns a Kubernetes client
func newK8sClient(conf Config) (kubernetes.Interface, error) {
	// Some config can be passed in a kubeconfig file
	kubeconfig := conf.Kubernetes.Kubeconfig

	config, err := kube.DefaultRestConfig(kubeconfig, "")
	if err != nil {

import (
	admin "github.com/envoyproxy/go-control-plane/envoy/admin/v3"
)

// GetBootstrapConfigDump retrieves the bootstrap config dump from the ConfigDump
func (w *Wrapper) GetBootstrapConfigDump() (*admin.BootstrapConfigDump, error) {
	bootstrapDumpAny, err := w.getSection(bootstrap)
	if err != nil {
		return nil, err
	}
	bootstrapDump := &admin.BootstrapConfigDump{}
	err = bootstrapDumpAny.UnmarshalTo(bootstrapDump)
	if err != nil {

					t.Fatal(err)
				}
			}

			t.Log("Expecting an invalid configuration log:")
			err := in.sleepWatchInstall(ctx, sets.String{})
			if err != nil {
				t.Fatalf("error should be nil due to invalid config, got: %v", err)
			}
			assert.Equal(t, isReady.Load(), false)

			if len(c.invalidConfigFilename) > 0 {
				if err := os.Remove(cniConfigFilepath); err != nil {
					t.Fatal(err)

var ErrNotImplemented = errors.New("not implemented")

// Program defines a method which programs iptables based on the parameters
// provided in Redirect.
func (ipt *iptables) Program(podName, netns string, rdrct *Redirect) error {
	return ErrNotImplemented

  // valid against the audience of the Kubernetes API server.
  // +optional
  repeated string audiences = 4;

  // Error indicates that the token couldn't be checked
  // +optional
  optional string error = 3;
}

// UserInfo holds the information about the user needed to implement the
// user.Info interface.
message UserInfo {

type MessageSlice []proto.Message

// MarshalJSON handles marshaling of slices of proto messages
func (pSlice MessageSlice) MarshalJSON() ([]byte, error) {
	buffer := bytes.NewBufferString("[")
	sliceLength := len(pSlice)
	for index, msg := range pSlice {
		b, err := protomarshal.Marshal(msg)
		if err != nil {
			return nil, err
		}
		buffer.Write(b)

	// A bit inexact but should be good enough.
	return strings.Contains(addr, ".googleapis.com/") || strings.Contains(addr, ".googleapis.com:443/")
}

func mcpTransport(ctx context.Context, tr http.RoundTripper) (http.RoundTripper, error) {
	creds, err := google.FindDefaultCredentials(ctx, "https://www.googleapis.com/auth/cloud-platform")
	if err != nil {
		return nil, fmt.Errorf("finding default GCP credentials: %w", err)
	}
	return &oauth2.Transport{

  // Reason is optional.  It indicates why a request was allowed or denied.
  // +optional
  optional string reason = 2;

  // EvaluationError is an indication that some error occurred during the authorization check.
  // It is entirely possible to get an error and be able to continue determine authorization status in spite of it.
  // For instance, RBAC can be missing a role, but enough roles are still present and bound to reason about the request.

  optional string patchType = 5;

  // AuditAnnotations is an unstructured key value map set by remote admission controller (e.g. error=image-blacklisted).
  // MutatingAdmissionWebhook and ValidatingAdmissionWebhook admission controller will prefix the keys with
  // admission webhook name (e.g. imagepolicy.example.com/error=image-blacklisted). AuditAnnotations will be provided by