"sigs.k8s.io/yaml"

	"istio.io/istio/pkg/util/protomarshal"
)

const typeURLPrefix = "type.googleapis.com/"

func (c *ConfigWriter) PrintEcds(outputFormat string) error {
	if c.configDump == nil {
		return fmt.Errorf("config writer has not been primed")
	}

	dump, err := c.configDump.GetEcdsConfigDump()
	if err != nil {
		return err
	}

func GetWebhookRevision(wh admitv1.MutatingWebhookConfiguration) (string, error) {
	if tagName, ok := wh.ObjectMeta.Labels[label.IoIstioRev.Name]; ok {
		return tagName, nil
	}
	return "", fmt.Errorf("could not extract tag revision from webhook")
}

// DeleteTagWebhooks deletes the given webhooks.
func DeleteTagWebhooks(ctx context.Context, client kubernetes.Interface, tag string) error {
	webhooks, err := GetWebhooksWithTag(ctx, client, tag)

func (w *Wrapper) getSection(sectionTypeURL configTypeURL) (*anypb.Any, error) {
	var dumpAny *anypb.Any
	for _, conf := range w.Configs {
		if conf.TypeUrl == string(sectionTypeURL) {
			dumpAny = conf
		}
	}
	if dumpAny == nil {
		return nil, fmt.Errorf("config dump has no configuration type %s", sectionTypeURL)
	}

	return dumpAny, nil
}

		if len(wh.Webhooks) != tc.numWebhooks {
			t.Errorf("expected %d webhook(s) in MutatingWebhookConfiguration, found %d",
				tc.numWebhooks, len(wh.Webhooks))
		}
		tag, exists := wh.ObjectMeta.Labels[IstioTagLabel]
		if !exists {
			t.Errorf("expected tag webhook to have %s label, did not find", IstioTagLabel)
		}
		if tag != tc.tagName {

package plugin

import "errors"

// ErrNotImplemented is returned when a requested feature is not implemented.
var ErrNotImplemented = errors.New("not implemented")

// Program defines a method which programs iptables based on the parameters
// provided in Redirect.
func (ipt *iptables) Program(podName, netns string, rdrct *Redirect) error {
	return ErrNotImplemented

		if r := cmp.Compare(a.Name, b.Name); r != 0 {
			return r
		}
		return cmp.Compare(a.Hostname, b.Hostname)
	})
	out, err := json.MarshalIndent(svcs, "", "    ")
	if err != nil {
		return fmt.Errorf("failed to marshal workloads: %v", err)
	}
	if outputFormat == "yaml" {
		if out, err = yaml.JSONToYAML(out); err != nil {
			return err
		}
	}
	fmt.Fprintln(c.Stdout, string(out))
	return nil

}

func mcpTransport(ctx context.Context, tr http.RoundTripper) (http.RoundTripper, error) {
	creds, err := google.FindDefaultCredentials(ctx, "https://www.googleapis.com/auth/cloud-platform")
	if err != nil {
		return nil, fmt.Errorf("finding default GCP credentials: %w", err)
	}
	return &oauth2.Transport{
		Base:   tr,
		Source: creds.TokenSource,
	}, nil

	revisions := map[string]*RevisionDescription{}

	// Get a list of control planes which are installed in remote clusters
	// In this case, it is possible that they only have webhooks installed.
	webhooks, err := Webhooks(context.Background(), client)
	if err != nil {
		return nil, fmt.Errorf("error while listing mutating webhooks: %v", err)
	}

	ProxyGID          *int64
}

// newK8sClient returns a Kubernetes client
func newK8sClient(conf Config) (kubernetes.Interface, error) {
	// Some config can be passed in a kubeconfig file
	kubeconfig := conf.Kubernetes.Kubeconfig

	config, err := kube.DefaultRestConfig(kubeconfig, "")
	if err != nil {
		log.Errorf("Failed setting up kubernetes client with kubeconfig %s", kubeconfig)
		return nil, err
	}

  // Reason is optional.  It indicates why a request was allowed or denied.
  // +optional
  optional string reason = 2;

  // EvaluationError is an indication that some error occurred during the authorization check.
  // It is entirely possible to get an error and be able to continue determine authorization status in spite of it.
  // For instance, RBAC can be missing a role, but enough roles are still present and bound to reason about the request.