}
	meshConfigMap, err := client.Kube().CoreV1().ConfigMaps(ctx.IstioNamespace()).Get(context.TODO(), meshConfigMapName, metav1.GetOptions{})
	if err != nil {
		return nil, fmt.Errorf("could not read valid configmap %q from namespace %q: %v - "+
			"Use --meshConfigFile or re-run "+command+" with `-i <istioSystemNamespace> and ensure valid MeshConfig exists",
			meshConfigMapName, ctx.IstioNamespace(), err)
	}

	}

	// create watched namespaces
	namespaces := strings.Split(oiArgs.common.watchedNamespaces, ",")
	// if the namespace in the CR is provided, consider creating it too.
	if istioNamespace != "" {
		namespaces = append(namespaces, istioNamespace)
	}
	for _, ns := range namespaces {
		if err := operatorutil.CreateNamespace(kubeClient.Kube(), ns, "", opts.DryRun); err != nil {
			l.LogAndFatal(err)
		}
	}

}

func verifyExecAndK8sConfigTestCaseTestOutput(t *testing.T, c execAndK8sConfigTestCase) {
	t.Helper()

	ctx := cli.NewFakeContext(&cli.NewFakeContextOption{
		Namespace:      c.namespace,
		IstioNamespace: c.istioNamespace,
		Results:        c.configDumps,
	})
	client, err := ctx.CLIClient()
	assert.NoError(t, err)
	// Override the Istio config factory
	for i := range c.istioConfigs {

imagePullSecrets:
  {{- range .Values.global.imagePullSecrets }}
  - name: {{ . }}
    {{- end }}
    {{- end }}
metadata:
  name: istio-reader-service-account
  namespace: {{ .Values.global.istioNamespace }}
  labels:
    app: istio-reader

apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingWebhookConfiguration
metadata:
  name: istio-validator{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}-{{ .Values.global.istioNamespace }}
  labels:
    app: istiod
    release: {{ .Release.Name }}
    istio: istiod
    istio.io/rev: {{ .Values.revision | default "default" | quote }}
webhooks:

defaults:
  global:
    # Used to locate istiod.
    istioNamespace: "istio-system"

  base:
    # Validation webhook configuration url
    # For example: https://$remotePilotAddress:15017/validate
    validationURL: ""

  istiodRemote:
    # Sidecar injector mutating webhook configuration url
    # For example: https://$remotePilotAddress:15017/inject
    injectionURL: ""

	return r
}

// Namespace returns the namespace flag value.
func (r *RootFlags) Namespace() string {
	return *r.namespace
}

// IstioNamespace returns the istioNamespace flag value.
func (r *RootFlags) IstioNamespace() string {
	return *r.istioNamespace
}

// DefaultNamespace returns the default namespace to use.
func (r *RootFlags) DefaultNamespace() string {
	if r.defaultNamespace == "" {

    # is processed as if it were declared in the leaf namespace.
    rootNamespace: {{ .Values.meshConfig.rootNamespace | default .Values.global.istioNamespace }}

  {{ $prom := include "default-prometheus" . | eq "true" }}
  {{ $sdMetrics := include "default-sd-metrics" . | eq "true" }}
  {{ $sdLogs := include "default-sd-logs" . | eq "true" }}

  imagePullSecrets: []

  # Specify image pull policy if default behavior isn't desired.
  # Default behavior: latest images will be Always else IfNotPresent.
  imagePullPolicy: ""

  # Used to replace istioNamespace to support operator watch multiple namespaces.
  watchedNamespaces: istio-system
  waitForResourcesTimeout: 300s

  # Used for helm2 to add the CRDs to templates.
  enableCRDTemplates: false

}

func (f *fakeInstance) Namespace() string {
	return f.rootFlags.Namespace()
}

func (f *fakeInstance) IstioNamespace() string {
	return f.rootFlags.IstioNamespace()
}

type NewFakeContextOption struct {
	Namespace      string
	IstioNamespace string
	Results        map[string][]byte
	// Objects are the objects to be applied to the fake client
	Objects []runtime.Object