# This will build the final image based on either debug or distroless from above
# hadolint ignore=DL3006
FROM ${BASE_DISTRIBUTION:-debug}

WORKDIR /

ARG proxy_version
ARG SIDECAR=envoy

# Copy Envoy bootstrap templates used by pilot-agent
COPY envoy_bootstrap.json /var/lib/istio/envoy/envoy_bootstrap_tmpl.json

		"ISTIO_BASE_REGISTRY": args.BaseImageRegistry,
		// Base distribution picks which variant to build
		"BASE_DISTRIBUTION": baseDist,
		// Additional metadata injected into some images
		"proxy_version":    args.ProxyVersion,
		"ztunnel_version":  args.ZtunnelVersion,
		"istio_version":    args.IstioVersion,
		"VM_IMAGE_NAME":    vmImageName(target),
		"VM_IMAGE_VERSION": vmImageVersion(target),
	}

		message := msg.NewEnvoyFilterUsesRelativeOperation(r)

		// if the proxyVersion is set choose that error message over the relative operation message as
		// the proxyVersion error message also indicates that the proxyVersion is set
		count := 0

		for _, name := range patchFilterNames {
			if instanceName == name {
				count++
				break
			}
		}

      proxy:
        proxyVersion: ^1\.19.*
  - applyTo: HTTP_FILTER
    match:
      context: SIDECAR_INBOUND
      listener:
        filterChain:
          filter:
            name: envoy.filters.network.http_connection_manager
            subFilter:
              name: envoy.filters.http.router
      proxy:
        proxyVersion: ^1\.19.*
  - applyTo: HTTP_FILTER
    match:

					{
						Patch: &networking.EnvoyFilter_Patch{},
						Match: &networking.EnvoyFilter_EnvoyConfigObjectMatch{
							Proxy: &networking.EnvoyFilter_ProxyMatch{ProxyVersion: `^1\.19.*`},
						},
					},
				},
			},
			"1.19",
			map[string]bool{
				"1.19":         true,
				"1.19.0":       true,
				"1.19-dev.foo": true,
				"1.5":          false,

			proxy,
			cb.req.Push,
			clusterName,
			model.TrafficDirectionOutbound, "", service.Hostname, port.Port,
			service, dr,
		)
	}
	return clusterCache{
		clusterName:     clusterName,
		proxyVersion:    cb.proxyVersion,
		locality:        cb.locality,
		proxyClusterID:  cb.clusterID,
		proxySidecar:    cb.sidecarProxy(),
		proxyView:       cb.proxyView,
		hbone:           cb.sendHbone,

		} else if cp.Match.Proxy != nil && cp.Match.Proxy.ProxyVersion != "" {
			// Attempt to convert regex to a simple prefix match for the common case of matching
			// a standard Istio version. This field should likely be replaced with semver, but for now
			// we can workaround the performance impact of regex
			if prefix, f := wellKnownVersions[cp.Match.Proxy.ProxyVersion]; f {
				cpw.ProxyPrefixMatch = prefix
			} else {

"http1MaxPendingRequests"
"http2MaxRequests"
"maxRequestsPerConnection"
"maxRetries"
"idleTimeout"
"h2UpgradePolicy"
"useClientProtocol"
"probes"
"from"
"to"
"workloadSelector"
"configPatches"
"proxyVersion"
"metadata"
"service"
"vhost"
"gateway"
"filterChain"
"operation"
"value"
"filterClass"
"context"
"proxy"
"listener"
"routeConfiguration"
"cluster"
"applyTo"
"match"
"patch"

	Separator = []byte{'~'}
	Slash     = []byte{'/'}
)

// Cache includes the variables that can influence a Route Configuration.
// Implements XdsCacheEntry interface.
type Cache struct {
	RouteName string

	ProxyVersion string
	// proxy cluster ID
	ClusterID string
	// proxy dns domain
	DNSDomain string
	// DNSCapture indicates whether the workload has enabled dns capture
	DNSCapture bool

kind: EnvoyFilter
metadata:
  name: test-auth-4
  namespace: bookinfo
spec:
  configPatches:
  - applyTo: HTTP_FILTER
    match:
      context: SIDECAR_INBOUND
      proxy:
        proxyVersion: '^1\.11.*'
      app: add4
    patch:
      operation: ADD
      filterClass: AUTHZ # This filter will run *after* the Istio authz filter.
      value:
        name: envoy.filters.http.ext_authz