// https://www.envoyproxy.io/docs/envoy/latest/api-v3/extensions/path/match/uri_template/v3/uri_template_match.proto
// If path contains "{*}", it will be replaced with "*".
// If path contains "{**}", it will be replaced with "**".
// If the path already contained "*" or "**", they will be left as is.
func sanitizePathTemplate(path string) string {
	return replacer.Replace(path)

		for _, base := range getObjectLabels() {
			base[label.IoIstioRev.Name] = rev
			objectLabels = append(objectLabels, base)
		}
	}

	// For each permutation, we check which webhooks it matches. It must match exactly 0 or 1!
	for _, nl := range namespaceLabels {
		for _, ol := range objectLabels {
			matches := sets.New[string]()
			for name, whs := range webhooks {
				for _, wh := range whs {

// metrics when configured with the Telemetry API (with EnvoyFilters disabled).
// This test focuses on stats filter and metadata exchange filter could work coherently with
// proxy bootstrap config with Wasm runtime. To avoid flake, it does not verify correctness
// of metrics, which should be covered by integration test in proxy repo.
func TestStatsFilter(t *testing.T) {
	expectedBuckets := DefaultBucketCount
	framework.NewTest(t).

	// ns, n := splitKeyFunc(string(k))
	// Internal optimization: we know kclient will eventually lookup "ns/name"
	// We also have a key in this format.
	// Rather than split and rejoin it later, just pass it as the name
	// This is depending on "unstable" implementation details, but we own both libraries and tests would catch any issues.
	if got := i.inf.Get(string(k), ""); !controllers.IsNil(got) {
		return &got
	}

		}
		log.Debugf("pod %s on node %s ready!", p.Name, p.Spec.NodeName)
		return p
	}, krt.WithStop(stop))

	// these are all the nodes that have a ready cni pod. if the cni pod is ready,
	// it means we are ok scheduling pods to it.
	readyCniNodes := krt.NewCollection(readyCniPods, func(ctx krt.HandlerContext, p v1.Pod) *v1.Node {
		pnode := krt.FetchOne(ctx, nodes, krt.FilterKey(p.Spec.NodeName))
		if pnode == nil {
			return nil

		// Whatever user has set (with --log_output_level) for 'cni-plugin', pass it down to the plugin. It will use this to determine
		// what level to use for itself.
		// This masks the fact we are doing this weird log-over-UDS to users, and allows them to configure it the same way.
		PluginLogLevel:        istiolog.LevelToString(istiolog.FindScope(constants.CNIPluginLogScope).GetOutputLevel()),

  tag: latest
  # Variant to pull. Options are "debug" or "distroless". Unset will use the default for the given version.
  variant: ""

  # Image name to pull from. Image will be `Hub/Image:Tag-Variant`
  # If Image contains a "/", it will replace the entire `image` in the pod.
  image: ztunnel

  # Labels to apply to all top level resources
  labels: {}
  # Annotations to apply to all top level resources
  annotations: {}

	ConfigTemplateInput any
	// If provided, this mesh config will be used
	MeshConfig      *meshconfig.MeshConfig
	NetworksWatcher mesh.NetworksWatcher

	// Callback to modify the kube client before it is started
	KubeClientModifier func(c kubelib.Client)

	// Override the default kube client constructor
	KubeClientBuilder func(objects ...runtime.Object) kubelib.Client

	NamespaceNotInjected = diag.NewMessageType(diag.Info, "IST0102", "The namespace is not enabled for Istio injection. Run 'kubectl label namespace %s istio-injection=enabled' to enable it, or 'kubectl label namespace %s istio-injection=disabled' to explicitly mark it as not needing injection.")

	// PodMissingProxy defines a diag.MessageType for message "PodMissingProxy".
	// Description: A pod is missing the Istio proxy.

		ns := ctx.NamespaceOrDefault(ctx.Namespace())
		if ctx.Namespace() == "" && !forApply {
			ns = ""
		}
		// If a user sets the waypoint name to an empty string, set it to the default namespace waypoint name.
		if waypointName == "" {
			waypointName = constants.DefaultNamespaceWaypoint
		} else if waypointName == "none" {