=== CMD (as-spec): kubectl -n istio-vt-t22 exec client -c istio-proxy -- curl -s 'localhost:15000/config_dump?resource=bootstrap' ===
bootstrap is not a repeated field. Use ?mask=bootstrap to get only this field
NOTE: spec command used '?resource=bootstrap' which is invalid for Envoy admin API
(bootstrap is not a repeated field). Retrying with corrected query param
'?mask=bootstrap' -- functionally equivalent (full config_dump filtered down to just
the bootstrap section) -- to obtain the data needed for the remaining jq checks.

=== CMD (corrected): kubectl -n istio-vt-t22 exec client -c istio-proxy -- curl -s 'localhost:15000/config_dump?mask=bootstrap' > /tmp/bootstrap.json ===
(saved 91128 bytes to /tmp/bootstrap.json)

=== CMD: jq -r '.configs[0].bootstrap.staticResources.clusters[].name' /tmp/bootstrap.json ===

jq: error - staticResources not found (actual JSON uses proto snake_case field names in this Envoy build).
NOTE: this Envoy admin API build serializes config_dump with original proto field names
(static_resources, dynamic_resources, ads_config, path_config_source) rather than
camelCase. Adapting all subsequent jq paths accordingly -- same fields, same semantics.

=== CMD (corrected field names): jq -r '.configs[0].bootstrap.static_resources.clusters[].name' /tmp/bootstrap.json ===
prometheus_stats
agent
sds-grpc
xds-grpc


=== CMD (corrected): jq -r '.configs[0].bootstrap.static_resources.clusters[].name' /tmp/bootstrap.json | grep -c 'outbound|' ===
0

=== CMD (corrected): jq '.configs[0].bootstrap.dynamic_resources' /tmp/bootstrap.json ===
{
  "lds_config": {
    "ads": {},
    "initial_fetch_timeout": "0s",
    "resource_api_version": "V3"
  },
  "cds_config": {
    "ads": {},
    "initial_fetch_timeout": "0s",
    "resource_api_version": "V3"
  },
  "ads_config": {
    "api_type": "DELTA_GRPC",
    "grpc_services": [
      {
        "envoy_grpc": {
          "cluster_name": "xds-grpc"
        }
      }
    ],
    "set_node_on_first_message_only": true,
    "transport_api_version": "V3"
  }
}

=== CMD (corrected field names): jq '.configs[0].bootstrap.dynamic_resources | to_entries[] | {key, ads: (.value.ads // .value.ads_config // empty)}' /tmp/bootstrap.json ===
{
  "key": "lds_config",
  "ads": {}
}
{
  "key": "cds_config",
  "ads": {}
}


=== CMD (corrected field name): jq -r '.. | .path_config_source? // empty' /tmp/bootstrap.json   # expect nothing printed (no file-based path config anywhere) ===
(no output -- confirms no pathConfigSource/path_config_source anywhere in bootstrap JSON)


=== SUPPLEMENTARY CHECK (not in spec, for own diligence): grep for any 'path' keys anywhere ===
in bootstrap JSON to confirm .path_config_source search wasn't masking a differently-named
file-based ConfigSource field.
binaryPath
configPath
envoy.reloadable_features.http_reject_path_with_fragment
path
profile_path
prometheus.io/path

-> only hits: 'path' (UDS pipe addresses for sds-grpc/xds-grpc clusters, e.g.
   ./var/run/secrets/workload-spiffe-uds/socket and ./etc/istio/proxy/XDS -- these are
   local unix-socket transport addresses to istio-agent, NOT xDS ConfigSource file paths),
   'configPath'/'binaryPath'/'profile_path' (envoy admin/runtime bootstrap paths, unrelated
   to xDS resource config), and 'prometheus.io/path' (pod annotation copied into node
   metadata). No path_config_source / file-based xDS ConfigSource found anywhere.