return c.StatefulSet
}

// IsNaked checks if the config has no sidecar.
// Note: instances that mix subsets with and without sidecars are considered 'naked'.
func (c Config) IsNaked() bool {
	for _, s := range c.Subsets {
		if s.Annotations != nil && s.Annotations[annotation.SidecarInject.Name] == "false" {
			// Sidecar injection is disabled - it's naked.
			return true
		}
	}
	return false
}

			wantException:    true,
			expectedOutput:   "Error: timeout expired before resource networking.istio.io/v1alpha3/VirtualService/default/bar became effective on all sidecars\n",
		},
		{
			execClientConfig: cannedResponseMap,
			args:             strings.Split("--timeout 2s virtualservice foo.default", " "),
			wantException:    false,
		},
		{

	case gvk.Sidecar:
		oldRes := &apiistioioapinetworkingv1alpha3.Sidecar{
			ObjectMeta: origMeta,
			Spec:       *(orig.Spec.(*istioioapinetworkingv1alpha3.Sidecar)),
		}
		modRes := &apiistioioapinetworkingv1alpha3.Sidecar{
			ObjectMeta: modMeta,
			Spec:       *(mod.Spec.(*istioioapinetworkingv1alpha3.Sidecar)),
		}
		patchBytes, err := genPatchBytes(oldRes, modRes, typ)

	return match.Network(from.Config().Cluster.NetworkName()).GetMatches(to)
}

// NoSelfCalls disallows self-calls where from and to have the same service name. Self-calls can
// by-pass the sidecar, so tests relying on sidecar logic will sent to disable self-calls by default.
var NoSelfCalls CombinationFilter = func(from echo.Instance, to echo.Instances) echo.Instances {

		ValidateProto: validation.ValidateServiceEntry,
	}.MustBuild()

	Sidecar = resource.Builder{
		Identifier: "Sidecar",
		Group:      "networking.istio.io",
		Kind:       "Sidecar",
		Plural:     "sidecars",
		Version:    "v1alpha3",
		VersionAliases: []string{
			"v1beta1",
			"v1",
		},
		Proto: "istio.networking.v1alpha3.Sidecar", StatusProto: "istio.meta.v1alpha1.IstioStatus",

				authorizeSidecar bool
				drSelector       string
				expectedResponse ingressutil.ExpectedResponse
			}{
				// Mutual TLS origination from an authorized sidecar to https endpoint
				{
					name:             "authorized sidecar",
					credentialToUse:  credNameGeneric,
					from:             apps.Ns1.A,
					drSelector:       "a",
					authorizeSidecar: true,
					expectedResponse: ingressutil.ExpectedResponse{

        type: string
      - name: host
        type: string

  - name: "ConflictingSidecarWorkloadSelectors"
    code: IST0110
    level: Error
    description: "A Sidecar resource selects the same workloads as another Sidecar resource"
    template: "The Sidecars %v in namespace %q select the same workload pod %q, which can lead to undefined behavior."
    args:
      - name: conflictingSidecars
        type: "[]string"

* Be lightweight enough to not limit adoption.
  * This puts a much tighter budget on CPU, memory, latency, and throughput requirements than traditional Istio sidecars.

Ztunnel was not designed to be a feature-rich data plane.
Quite the opposite - an *aggressively* small feature set is the key feature that makes ztunnel viable.

//     If the pod's terminationGracePeriod is shorter than our drain duration (rare), we may be a SIGKILL.
//  4. /drain + SIGTERM. This is the shutdown when using Kubernetes native sidecars.
//     /drain is called when the pod shutdown starts. We start draining, forever.
//     Once the app containers shutdown, we get a SIGTERM. We have no use to run anymore, so shutdown immediately.

			}
		}

		return true, nil
	}

	workloads, _ := c.Workloads()
	// Wait for the outbound config to be received by each workload from Pilot.
	for _, w := range workloads {
		if w.Sidecar() != nil {
			if err := w.Sidecar().WaitForConfig(accept, retry.Timeout(time.Second*10)); err != nil {
				return err
			}
		}
	}

	return nil