// its doing something unique to that specific test.
	apps = &EchoDeployments{}
)

type EchoDeployments struct {
	// Namespace echo apps will be deployed
	Namespace namespace.Instance
	// Captured echo service
	Captured echo.Instances
	// Uncaptured echo Service
	Uncaptured echo.Instances
	// Sidecar echo services with sidecar
	Sidecar echo.Instances

	// All echo services
	All echo.Instances
}

        BeforeExecutionState thisExecution,
        IncrementalInputProperties incrementalInputProperties
    ) {
        // Capture changes in execution outcome
        ChangeContainer previousSuccessState = new PreviousSuccessChanges(
            lastExecution.isSuccessful());

        // Capture changes to implementation

        // After validation, the current implementations and previous implementations can't be unknown.

}

// This test is designed to ensure that write errors are properly
// handled by the code that writes out coverage data. It repeatedly
// invokes the 'emit to writer' apis using a specially crafted writer
// that captures the total number of expected writes, then replays the
// execution N times with a manufactured write error at the
// appropriate spot.
func emitToFailingWriter() {
	log.SetPrefix("emitToFailingWriter: ")

apiVersion: release-notes/v2
kind: feature
area: traffic-management
issue:
  - 50736
releaseNotes:
- |
  **Added** Allow pods to be opted out of ambient capture using the `istio.io/dataplane-mode=none` label.

                      TF_Message(tf_status));
  TF_ForEachPayload(
      tf_status,
      [](const char* key, const char* value, void* capture) {
        absl::Status* status = static_cast<absl::Status*>(capture);
        status->SetPayload(key, absl::Cord(absl::string_view(value)));
      },
      &status);
  return status;
}

     */
    LoggingManagerInternal captureSystemSources();

    /**
     * Sets the log level to capture stdout at. Does not enable capture.
     */
    @Override
    LoggingManagerInternal captureStandardOutput(LogLevel level);

    /**
     * Sets the log level to capture stderr at. Does not enable capture.
     */
    @Override
    LoggingManagerInternal captureStandardError(LogLevel level);

	TProxy      WorkloadClass = "tproxy"
	Naked       WorkloadClass = "naked"
	External    WorkloadClass = "external"
	StatefulSet WorkloadClass = "statefulset"
	Headless    WorkloadClass = "headless"
	Captured    WorkloadClass = "captured"
	Waypoint    WorkloadClass = "waypoint"
	Standard    WorkloadClass = "standard"

     * that will be captured by this trace. When enabled, only operations matching this filter
     * will be captured. This enables capturing a build operation traces of larger builds that
     * would otherwise be too large to capture.
     *
     * When this property is set, a complete build operation tree is not captured. In this

spec:
  profile: ambient
  components:
    ingressGateways:
      - name: istio-ingressgateway
        enabled: true
  values:
    cni:
      ambient:
        # Some of the tests require DNS capture
        # For that, DNS capture must be enabled in the CNI
        # and DNS proxying must be enabled in ztunnel
        dnsCapture: true
    ztunnel:
      meshConfig:
        defaultConfig:
          proxyMetadata:

// via the nodeIP
// - kubelet (node-local healthchecks, which we do not capture)
// - kube-proxy (fowarded/proxied traffic from LoadBalancer-backed services, potentially with public IPs, which we must capture)
func (cfg *IptablesConfigurator) CreateHostRulesForHealthChecks(hostSNATIP, hostSNATIPV6 *netip.Addr) error {
	// Append our rules here