req, err := http.NewRequest("GET", "/metrics/resources", nil)
	if err != nil {
		t.Fatal(err)
	}
	h.ServeHTTP(r, req)

	expected := `# HELP kube_pod_resource_limit [STABLE] Resources limit for workloads on the cluster, broken down by pod. This shows the resource usage the scheduler and kubelet expect per pod for resources along with the unit for the resource if any.
# TYPE kube_pod_resource_limit gauge

type ConfigWriter struct {
	Stdout      io.Writer
	ztunnelDump *ZtunnelDump
	FullDump    []byte
}

type rawDump struct {
	Services      json.RawMessage          `json:"services"`
	Workloads     json.RawMessage          `json:"workloads"`
	Policies      json.RawMessage          `json:"policies"`
	Certificates  json.RawMessage          `json:"certificates"`
	WorkloadState map[string]WorkloadState `json:"workloadstate"`
}

			ServiceNames: slices.Map(services, func(e *v1.Service) string { return e.Name }),
		}
	})
	Workloads.Register(func(e krt.Event[Workload]) {
		events <- fmt.Sprintf(e.Latest().Name, e.Event)
	})
}

type legacy struct {
	pods      kclient.Client[*v1.Pod]
	services  kclient.Client[*v1.Service]
	queue     controllers.Queue
	workloads map[types.NamespacedName]*Workload
	handler   func(event krt.Event[Workload])
}

func (c *ConfigWriter) PrintWorkloadSummary(filter WorkloadFilter) error {
	w := c.tabwriter()
	zDump := c.ztunnelDump

	verifiedWorkloads := make([]*ZtunnelWorkload, 0, len(zDump.Workloads))
	for _, wl := range zDump.Workloads {
		if filter.Verify(wl) {
			verifiedWorkloads = append(verifiedWorkloads, wl)
		}
	}

	// Sort by name, node
	sort.Slice(verifiedWorkloads, func(i, j int) bool {

apiVersion: release-notes/v2
kind: feature
area: istioctl
releaseNotes:
- |

issue: []

docs: []

releaseNotes:
- |
  **Added** values to the Istio Gateway Helm chart for configuring [topologySpreadConstraints](https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/) on the Deployment. Can be used for better placement of Istio gateway workloads.

upgradeNotes: []

issue:
- 42938

docs: []

releaseNotes:
- |
  **Added** values to the Istiod Helm chart for configuring [topologySpreadConstraints](https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/) on the Deployment. Can be used for better placement of istiod workloads.

upgradeNotes: []

  metrics with junk data (and exploding metrics cardinality). With this change, it is possible that users relying on
  host headers for labeling the destination service for inbound traffic from out-of-mesh workloads will see that traffic
  labeled as `unknown`. The behavior can be restored by modifying Istio configuration to remove the `disable_host_header_fallback: true`
  configuration.
upgradeNotes:

}

enum Scope {
  // ALL means that the authorization policy will be applied to all workloads
  // in the mesh (any namespace).
  GLOBAL = 0;
  // NAMESPACE means that the policy will only be applied to workloads in a
  // specific namespace.
  NAMESPACE = 1;
  // WORKLOAD_SELECTOR means that the policy will only be applied to specific
  // workloads that were selected by their labels.
  WORKLOAD_SELECTOR = 2;
}

enum Action {

		Run(func(t framework.TestContext) {
			if t.Settings().Skip(echo.TProxy) {
				t.Skip()
			}
			workloads, err := apps.A[0].Workloads()
			if err != nil {
				t.Errorf("failed to get Subsets: %v", err)
				return
			}
			// check the server can see the client's original ip
			var srcIps []string
			for _, w := range workloads {
				srcIps = append(srcIps, w.Address())
			}
			checkOriginalSrcIP(t, apps.A[0], apps.Tproxy[0], srcIps)