{
      "etcd_endpoints": "http://10.110.0.136:6666",
      "ipam": {
        "type": "calico-ipam"
      },
      "kubernetes": {
        "kubeconfig": "/etc/cni/net.d/calico-kubeconfig"
      },
      "log_level": "info",
      "mtu": 1500,
      "policy": {
        "type": "k8s"
      },
      "type": "calico"
    },
    {
      "capabilities": {
        "portMappings": true
      },
      "snat": true,

  // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
  // +optional
  optional NetworkPolicyStatus status = 3;
}

// NetworkPolicyEgressRule describes a particular set of traffic that is allowed out of pods
// matched by a NetworkPolicySpec's podSelector. The traffic must match both ports and to.
// This type is beta-level in 1.8
message NetworkPolicyEgressRule {

# Backporting fixes

* Cherry-picking is discussed in the original PR and subject-matter experts have approved the backport.
    * Behavioral changes should be highly scrutinized, while typo fixes don't require that level of scrutiny.
* It is preferable that cherry-picks are done by the istio-testing bot.
    * Automated cherry-picks do not need subject-matter experts to approve if discussed in the original PR.

			expectedString: "+    profile: openshift",
			// The profile doesn't change istiocoredns, so we shouldn't see this in the diff
			notExpected: "-    istiocoredns:",
			// 'profile diff' "fails" so that the error level `$?` is 1, not 0, if there is a diff
			shouldFail: false,
		},
	}

	l := clog.NewConsoleLogger(os.Stdout, os.Stderr, nil)
	for i, c := range cases {
		t.Run(fmt.Sprintf("case %d %q", i, c.args), func(t *testing.T) {

	"istio.io/istio/pkg/test/env"
	"istio.io/istio/pkg/test/util/assert"
)

var (
	extendedClient kube.CLIClient
	kubeClient     client.Client
)

// TODO: rewrite this with running the actual top level command.
func TestOperatorDump(t *testing.T) {
	goldenFilepath := filepath.Join(env.IstioSrc, "operator/cmd/mesh/testdata/operator/output/operator-dump.yaml")

	odArgs := &operatorDumpArgs{
		common: operatorCommonArgs{

	return "Level"
}

// Set is a function declared in the pflag.Value interface
func (m *MessageThreshold) Set(s string) error {
	levelMap := diag.GetUppercaseStringToLevelMap()
	level, ok := levelMap[strings.ToUpper(s)]
	if !ok {
		return errors.New("invalid level option")
	}
	m.Level = level
	return nil

  # values in this config will be automatically populated.
  cni_network_config: |-
        {
          "cniVersion": "0.3.1",
          "name": "istio-cni",
          "type": "istio-cni",
          "log_level": {{ quote .Values.cni.logLevel }},
          "log_uds_address": "__LOG_UDS_ADDRESS__",
          {{if .Values.cni.ambient.enabled}}"ambient_enabled": true,{{end}}
          "cni_event_address": "__CNI_EVENT_ADDRESS__",

    - --proxyComponentLogLevel={{ annotation .ObjectMeta `sidecar.istio.io/componentLogLevel` .Values.global.proxy.componentLogLevel }}
    - --log_output_level={{ annotation .ObjectMeta `sidecar.istio.io/agentLogLevel` .Values.global.logging.level }}
  {{- if .Values.global.sts.servicePort }}
    - --stsPort={{ .Values.global.sts.servicePort }}
  {{- end }}
  {{- if .Values.global.logAsJson }}
    - --log_as_json

   Matching subsets: 
      (Non-matching subsets v1)
   Traffic Policy TLS Mode: ISTIO_MUTUAL
   Policies: load balancer/connection pool/outlier detection
   Port Level Settings:
    8080:
      TLS Mode: DISABLE
      Policies: load balancer/connection pool/outlier detection
VirtualService: bookinfo
   Route to host "productpage" with weight 30%

			wantException:    true,
		},
		{ // logger name valid and logging level valid
			execClientConfig: loggingConfig,
			args:             strings.Split("log ztunnel-9v7nw --level ztunnel::pool:debug", " "),
			expectedString:   "",
			wantException:    false,
		},
		{ // set ztunnel logging level
			execClientConfig: loggingConfig,
			args:             strings.Split("log ztunnel-9v7nw --level debug", " "),