} else {
				// pre-compile the regex for proxy version if it exists
				// ignore the error because validation catches invalid regular expressions.
				cpw.ProxyVersionRegex, _ = regexp.Compile(cp.Match.Proxy.ProxyVersion)
			}
		}

		if _, exists := out.Patches[cp.ApplyTo]; !exists {
			out.Patches[cp.ApplyTo] = make([]*EnvoyFilterConfigPatchWrapper, 0)
		}
		if cpw.Operation == networking.EnvoyFilter_Patch_INSERT_AFTER ||

}

// applyKubeletConfigPatches reads patches from a directory and applies them over the input kubeletBytes
func applyKubeletConfigPatches(kubeletBytes []byte, patchesDir string, output io.Writer) ([]byte, error) {
	patchManager, err := patches.GetPatchManagerForPath(patchesDir, patches.KnownTargets(), output)
	if err != nil {
		return nil, err
	}

	patchTarget := &patches.PatchTarget{

	})
	// In case the patches cause panic, use the clusters generated before to reduce the influence.
	out = c
	if efw == nil {
		return
	}
	for _, cp := range efw.Patches[networking.EnvoyFilter_CLUSTER] {
		applied := false
		if cp.Operation != networking.EnvoyFilter_Patch_MERGE {
			IncrementEnvoyFilterMetric(cp.Key(), Cluster, applied)
			continue
		}
		if commonConditionMatch(pctx, cp) && clusterMatch(c, cp, hosts) {

		fg := fuzz.New(t, data)
		patches := fuzz.Slice[*networking.EnvoyFilter_EnvoyConfigObjectPatch](fg, patchCount%30)
		proxy := fuzz.Struct[*model.Proxy](fg)
		mesh := fuzz.Struct[*meshconfig.MeshConfig](fg)
		c := fuzz.Struct[*cluster.Cluster](fg)

		serviceDiscovery := memory.NewServiceDiscovery()
		env := newTestEnvironment(serviceDiscovery, mesh, buildEnvoyFilterConfigStore(patches))
		push := model.NewPushContext()

	CertificateRenewal = "certificate-renewal"

	// EtcdUpgrade flag instructs kubeadm to execute etcd upgrade during upgrades
	EtcdUpgrade = "etcd-upgrade"

	// Patches flag sets the folder where kubeadm component patches are stored
	Patches = "patches"

	// PrintManifest flag instructs kubeadm to print the addon manifests to STDOUT instead of installing them.
	PrintManifest = "print-manifest"

		`supported by kubectl. The default "patchtype" is "strategic". "extension" must be either ` +
		`"json" or "yaml". "suffix" is an optional string that can be used to determine ` +
		`which patches are applied first alpha-numerically.`
	fs.StringVar(patchesDir, Patches, *patchesDir, usage)

            # Port 5353 is forwarded to kube-dns
            - port: 5353
              name: tcp-dns
          overlays:
            - kind: Deployment
              name: ilb-gateway
              patches:
                - path: spec.template.spec.containers.[name:istio-proxy].env.[name:PILOT_CERT_PROVIDER].value

if you've tripped over a bug.

## Contributing code

Please read the
[Contribution Guidelines](https://golang.org/doc/contribute.html) before sending
patches.

Unless otherwise noted, the Go source files are distributed under the BSD-style

	result := make([]*core.TypedExtensionConfig, 0)
	if efw == nil {
		return result
	}
	hasName := sets.New(names...)
	for _, p := range efw.Patches[networking.EnvoyFilter_EXTENSION_CONFIG] {
		if p.Operation != networking.EnvoyFilter_Patch_ADD {
			continue
		}
		ec, ok := p.Value.(*core.TypedExtensionConfig)
		if !ok {

			TTL:    &metav1.Duration{Duration: 1234},
		},
	}
	obj.SkipPhases = nil
	obj.NodeRegistration.ImagePullPolicy = corev1.PullIfNotPresent
	obj.NodeRegistration.ImagePullSerial = ptr.To(true)
	obj.Patches = nil
	obj.DryRun = false
	kubeadm.SetDefaultTimeouts(&obj.Timeouts)
}

func fuzzNodeRegistration(obj *kubeadm.NodeRegistrationOptions, c fuzz.Continue) {
	c.FuzzNoCustom(obj)