return x.WorkloadInfo
	}
	return nil
}

// Keep workload that we can't find in the fd cache. This can only be sent before SnapshotSent is sent
// to signal ztunnel to not delete the workload if it has it.
type KeepWorkload struct {
	state         protoimpl.MessageState
	sizeCache     protoimpl.SizeCache
	unknownFields protoimpl.UnknownFields

	Uid string `protobuf:"bytes,1,opt,name=uid,proto3" json:"uid,omitempty"`

	for {
		// if sleepWatchInstall yields without error, that means the config might have been modified in some fashion.
		// so we rerun `install`, which will update the modified config if it has fallen out of sync with
		// our desired state
		err := in.sleepWatchInstall(ctx, installedBins)
		if err != nil {
			installLog.Error("error watching node CNI config")
			return err
		}

			}
		}
	}
	patchNetworkFilters(patchContext, patches, lis, fc)
}

// Test if the patch contains a config for TransportSocket
// Returns a boolean indicating if the merge was handled by this function; if false, it should still be called
// outside of this function.
func mergeTransportSocketListener(fc *listener.FilterChain, lp *model.EnvoyFilterConfigPatchWrapper) (merged bool, err error) {

	maxFormattersLength = 3

	DevStdout = "/dev/stdout"

	builtinEnvoyAccessLogProvider = "envoy"
)

var (
	// this is used for testing. it should not be changed in regular code.
	clusterLookupFn = LookupCluster

	// EnvoyJSONLogFormatIstio map of values for envoy json based access logs for Istio 1.9 onwards.

	// a better choice, it introduces a race condition; If we complete initialization of a new push
	// context between initializeProxy and addCon, we would not get any pushes triggered for the new
	// push context, leading the proxy to have a stale state until the next full push.
	s.addCon(con.ID(), con)
	// Register that initialization is complete. This triggers to calls that it is safe to access the
	// proxy

	// WaypointProxies by
	WaypointProxies map[string]ambient.WaypointProxy
}

// TestMain defines the entrypoint for pilot tests using a standard Istio installation.
// If a test requires a custom install it should go into its own package, otherwise it should go
// here to reuse a single install across tests.
func TestMain(m *testing.M) {
	// nolint: staticcheck
	framework.
		NewSuite(m).
		RequireMinVersion(24).

	if len(addr) == 0 {
		return netip.Prefix{}, fmt.Errorf("empty address")
	}

	// Already a CIDR, just parse it.
	if strings.Contains(addr, "/") {
		return netip.ParsePrefix(addr)
	}

	// Otherwise it is a raw IP. Make it a /32 or /128 depending on family
	ipa, err := netip.ParseAddr(addr)
	if err != nil {
		return netip.Prefix{}, err
	}

		cp(wd+k8sSvcAcctSubDir+f, tempK8sSvcAcctDir+"/"+f, t)
	}
	t.Logf("Finished pre-populating working dirs")
}

// create an install server instance and run it, blocking until it gets terminated
// via context cancellation
func startInstallServer(ctx context.Context, serverConfig *config.Config, t *testing.T) {
	readyFlag := &atomic.Value{}

func (Scope) EnumDescriptor() ([]byte, []int) {
	return file_workloadapi_security_authorization_proto_rawDescGZIP(), []int{0}
}

type Action int32

const (
	// Allow the request if it matches with the rules.
	Action_ALLOW Action = 0
	// Deny the request if it matches with the rules.
	Action_DENY Action = 1
)

// Enum value maps for Action.
var (
	Action_name = map[int32]string{
		0: "ALLOW",
		1: "DENY",
	}

	return subsetCluster.build()
}

// applyDestinationRule applies the destination rule if it exists for the Service.
// It returns the subset clusters if any created as it applies the destination rule.
func (cb *ClusterBuilder) applyDestinationRule(mc *clusterWrapper, clusterMode ClusterMode, service *model.Service,