responses []*discovery.DiscoveryResponse
		err       error
	)

	if options.XdsViaAgents {
		responses, err = queryDebugSynczViaAgents(all, dr, istioNamespace, kubeClient, centralOpts, options)
	} else {
		// Self-administered case.  Find all Istiods in revision using K8s, port-forward and call each in turn
		responses, err = queryEachShard(all, dr, istioNamespace, kubeClient, centralOpts)
	}
	if err != nil {

          },
          "expr": "irate(process_cpu_seconds_total{app=\"istiod\"}[1m])",
          "format": "time_series",
          "hide": false,
          "intervalFactor": 2,
          "legendFormat": "pilot (self-reported)",
          "refId": "C",
          "step": 2
        }
      ],
      "title": "vCPU",
      "type": "timeseries"
    },
    {
      "datasource": {

  // More info: https://examples.k8s.io/mysql-cinder-pd/README.md
  optional string volumeID = 1;

  // fsType Filesystem type to mount.
  // Must be a filesystem type supported by the host operating system.
  // Examples: "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" if unspecified.
  // More info: https://examples.k8s.io/mysql-cinder-pd/README.md
  // +optional
  optional string fsType = 2;

		iptableslog.UndefinedCommand, ChainInpodOutput, iptablesconstants.NAT,
		"-p", "tcp",
		"-m", "mark",
		"--mark", inpodTproxyMark,
		"-j", "ACCEPT",
	)

	// Do not redirect app calls to back itself via Ztunnel when using the endpoint address
	// e.g. appN => appN by lo
	iptablesBuilder.AppendVersionedRule("127.0.0.1/32", "::1/128",
		iptableslog.UndefinedCommand, ChainInpodOutput, iptablesconstants.NAT,

query results are printed to the console, organized by workload name.

All metrics returned are from server-side reports. This means that latencies
and error rates are from the perspective of the service itself and not of an
individual client (or aggregate set of clients). Rates and latencies are
calculated over a time interval of 1 minute.
`,
		Example: `  # Retrieve workload metrics for productpage-v1 workload

  // prefixed with a single wildcard label (e.g. "*.foo.com").
  // The wildcard character '*' must appear by itself as the first DNS label and
  // matches only a single label. You cannot have a wildcard label by itself (e.g. Host == "*").
  // Requests will be matched against the Host field in the following way:

message Duration {
  optional int64 duration = 1;
}

// FieldsV1 stores a set of fields in a data structure like a Trie, in JSON format.
//
// Each key is either a '.' representing the field itself, and will always map to an empty set,
// or a string representing a sub-field or item. The string will follow one of these four formats:
// 'f:<name>', where <name> is the name of a field in a struct, or key in a map

	// descendants of a kubepods directory, however, as of Kubernetes 1.21, cgroups
	// namespaces are in use and therefore we can no longer discern if that is the
	// case from within SPIRE agent container (since the container itself is
	// namespaced). As such, the regex has been relaxed to simply find the pod UID
	// followed by the container ID with allowances for arbitrary punctuation, and
	// container runtime prefixes, etc.
	regexp.MustCompile(`` +

// +structType=atomic
message MatchResources {
  // NamespaceSelector decides whether to run the admission control policy on an object based
  // on whether the namespace for that object matches the selector. If the
  // object itself is a namespace, the matching is performed on
  // object.metadata.labels. If the object is another cluster scoped resource,
  // it never skips the policy.
  //