description: "A namespace is not enabled for Istio injection."
    template: "The namespace is not enabled for Istio injection. Run 'kubectl label namespace %s istio-injection=enabled' to enable it, or 'kubectl label namespace %s istio-injection=disabled' to explicitly mark it as not needing injection."
    args:
      - name: namespace
        type: string
      - name: namespace2
        type: string

  - name: "PodMissingProxy"
    code: IST0103

		// TODO(hanxiaop): I think experimental version still has issues, so we keep the old version for now.
		version.XdsVersionCommand(ctx),
		// TODO(hanxiaop): this is kept for some releases in case someone is using it.
		proxystatus.XdsStatusCommand(ctx),
	}
	troubleshootingCommands := []*cobra.Command{
		version.NewVersionCommand(ctx),
		proxystatus.StableXdsStatusCommand(ctx),
	}
	var debugCmdAttachmentPoint *cobra.Command

		return fmt.Errorf("errors occurred during operation")
	}

	// Previously we may install IOP file from the old version of istioctl. Now since we won't install IOP file
	// anymore, and it didn't provide much value, we can delete it if it exists.
	reconciler.DeleteIOPInClusterIfExists(iop)

	opts.ProgressLog.SetState(progress.StateComplete)

	return nil
}

func savedIOPName(iop *v1alpha12.IstioOperator) string {

	<-sigs
}

func returnIfNotTooLong(body string) string {
	// Maximum size of a header accepted by Envoy is 60KiB, so when the request body is bigger than 60KB,
	// we don't return it in a response header to avoid rejecting it by Envoy and returning 431 to the client
	if len(body) > 60000 {
		return "<too-long>"
	}
	return body

			return excludedInboundPorts
		}
		port = strings.TrimSpace(port)
		if len(port) > 0 {
			outPorts = append(outPorts, port)
		}
	}

	// The port was not already excluded - exclude it now.
	outPorts = append(outPorts, portStr)
	return strings.Join(outPorts, ",")
}

func valueOrDefault(value any, defaultValue any) any {
	if value == "" || value == nil {
		return defaultValue
	}

		}
	}
	checkWildcard := func(field string, values []string) {
		for _, val := range values {
			if val == "*" {
				errs = multierror.Append(errs, fmt.Errorf("a single wildcard (\"*\") is not supported, change it to either prefix or suffix match: %s", field))
			}
		}
	}
	checkWildcard("IncludeRequestHeadersInCheck", config.IncludeRequestHeadersInCheck)
	//nolint: staticcheck

	stop := test.NewStop(t)

	c := NewController(store, "pilot-x", keepalive.Infinity)
	go c.Run(stop)

	proxy := fakeProxySuitableForHealthChecks(weB)
	// change proxy metadata to make it unsuitable for health checks
	proxy.Metadata.WorkloadEntry = "non-exisiting-workload-entry"

	err := c.OnConnect(makeConn(proxy, time.Now()))
	assert.Error(t, err)
}

	"istio.io/istio/pkg/platform"
	"istio.io/istio/pkg/test"
	"istio.io/istio/pkg/test/util/assert"
	"istio.io/istio/pkg/util/sets"
)

// TestInjection tests both the mutating webhook and kube-inject. It does this by sharing the same input and output
// test files and running through the two different code paths.
func TestInjection(t *testing.T) {
	type testCase struct {
		in            string
		want          string

  // first time it is resumed. This field is reset every time a Job is resumed
  // from suspension. It is represented in RFC3339 form and is in UTC.
  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.Time startTime = 2;

  // Represents time when the job was completed. It is not guaranteed to
  // be set in happens-before order across separate operations.
  // It is represented in RFC3339 form and is in UTC.

	NetworkManager *NetworkManager

	// mutex used for protecting Environment.pushContext
	mutex sync.RWMutex
	// pushContext holds information during push generation. It is reset on config change, at the beginning
	// of the pushAll. It will hold all errors and stats and possibly caches needed during the entire cache computation.
	// DO NOT USE EXCEPT FOR TESTS AND HANDLING OF NEW CONNECTIONS.