PeerAuths krt.Collection[*securityclient.PeerAuthentication],
	meshCfg *MeshConfig,
	workloadLabels map[string]string,
	workloadNamespace string,
) []string {
	// We need to filter from the policies that are present, which apply to us.
	// We only want label selector ones; global ones are not attached to the final WorkloadInfo
	// In general we just take all of the policies

  // currentAverageUtilization is the current value of the average of the
  // resource metric across all relevant pods, represented as a percentage of
  // the requested value of the resource for the pods.  It will only be
  // present if `targetAverageValue` was set in the corresponding metric
  // specification.
  // +optional
  optional int32 currentAverageUtilization = 2;

  // currentAverageValue is the current value of the average of the

		t.Errorf("trustbundle intermediate cert update test failed. Callback value is %v", cbCounter)
	}

	// Try adding one more cert to a different source
	// Ensure both certs are not present
	err = tb.UpdateTrustAnchor(&TrustAnchorUpdate{
		TrustAnchorConfig: TrustAnchorConfig{Certs: []string{rootCACert}},
		Source:            SourceIstioCA,
	})
	if err != nil {

			if err != nil {
				t.Error(err)
			}
			// we should have all the conditions present
			retry.UntilSuccessOrFail(t, func() error {
				// should update
				return expectWorkloadEntryStatus(t, ns, []*v1alpha1.IstioCondition{
					{
						Type:   "Health",

							WasmSecretEnv:          "secret-name",
							WasmResourceVersionEnv: "dummy-resource-version",
						},
					},
				},
			},
		},
		{
			desc:   "Build VMConfig with if-not-present pull policy",
			vm:     nil,
			policy: extensions.PullPolicy_IfNotPresent,
			expected: &wasmextensions.PluginConfig_VmConfig{
				VmConfig: &wasmextensions.VmConfig{
					Runtime: defaultRuntime,

			log.Errorf("failed to read mesh config from ConfigMap: %v", err)
			return
		}
		w.HandleMeshConfig(meshConfig)
	})

	go c.Run(stop)

	// Ensure the ConfigMap is initially loaded if present.
	if !client.WaitForCacheSync("configmap watcher", stop, c.HasSynced) {
		log.Error("failed to wait for cache sync")
	}
	return w
}

)

var securityLog = istiolog.RegisterScope("security", "security debugging")

const (
	// etc/certs files are used with external CA managing the certs,
	// i.e. mounted Secret or external plugin.
	// If present, FileMountedCerts should be true.

	// DefaultCertChainFilePath is the well-known path for an existing certificate chain file
	DefaultCertChainFilePath = "./etc/certs/cert-chain.pem"

func SortedList[T constraints.Ordered](s Set[T]) []T {
	res := s.UnsortedList()
	slices.Sort(res)
	return res
}

// InsertContains inserts the item into the set and returns if it was already present.
// Example:
//
//		if !set.InsertContains(item) {
//			fmt.Println("Added item for the first time", item)
//	  }
func (s Set[T]) InsertContains(item T) bool {
	if s.Contains(item) {
		return true
	}

	assert.EventuallyEqual(
		t,
		fetch(unpatchedWebhookConfig.Name),
		webhookConfigWithCABundleIgnore,
		retry.Message("no config update when endpoint not present"),
		LongRetry,
	)
	webhooks.Delete(unpatchedWebhookConfig.Name, "")

	// verify the webhook is updated after the controller can confirm invalid config is rejected.

	return cmd
}

func printCheckInjectorResults(writer io.Writer, was []webhookAnalysis) error {
	if len(was) == 0 {
		fmt.Fprintf(writer, "ERROR: no Istio injection hooks present.\n")
		return nil
	}
	w := table.NewStyleWriter(writer)
	w.SetAddRowFunc(func(obj interface{}) table.Row {
		wa := obj.(webhookAnalysis)
		row := table.Row{
			Cells: make([]table.Cell, 0),
		}