expectedError: "requested TTL 3h0m0s is greater than the max allowed TTL 2h0m0s",
		},
		"CSR uses EC TTL error": {
			forCA: false,
			certOpts: util.CertOptions{
				Org:      "istio.io",
				ECSigAlg: util.EcdsaSigAlg,
			},
			maxTTL:        2 * time.Hour,
			requestedTTL:  3 * time.Hour,
			expectedError: "requested TTL 3h0m0s is greater than the max allowed TTL 2h0m0s",
		},
	}

	// d.Round(    1s) = 1h15m31s
	// d.Round(    2s) = 1h15m30s
	// d.Round(  1m0s) = 1h16m0s
	// d.Round( 10m0s) = 1h20m0s
	// d.Round(1h0m0s) = 1h0m0s
}

func ExampleDuration_String() {
	fmt.Println(1*time.Hour + 2*time.Minute + 300*time.Millisecond)
	fmt.Println(300 * time.Millisecond)
	// Output:
	// 1h2m0.3s
	// 300ms
}

func ExampleDuration_Truncate() {
	d, err := time.ParseDuration("1h15m30.918273645s")

  kubeconfig: /var/lib/kube-proxy/kubeconfig.conf
  qps: 5
clusterCIDR: 10.244.0.0/16
configSyncPeriod: 15m0s
conntrack:
  maxPerCore: 32768
  min: 131072
  tcpCloseWaitTimeout: 1h0m0s
  tcpEstablishedTimeout: 24h0m0s
enableProfiling: false
healthzBindAddress: 0.0.0.0:10256
hostnameOverride: ""
iptables:
  masqueradeAll: false
  masqueradeBit: 14
  minSyncPeriod: 0s
  syncPeriod: 30s
ipvs:

Example: The following settings will increase the heal operation speed by allowing healing operation to run without delay up to `100` concurrent requests, and the maximum delay between each heal operation is set to `300ms`.

```sh
~ mc admin config set alias/ heal max_sleep=300ms max_io=100
```

Once set the healer settings are automatically applied without the need for server restarts.

## Environment only settings (not in config)

### Browser

        - MUTUAL_TLS
        {{- else }}
        - --controlPlaneAuthPolicy
        - NONE
        {{- end }}
        - --dnsRefreshRate
        - {{ valueOrDefault .Values.global.proxy.dnsRefreshRate "300s" }}
      {{- if (ne (annotation .ObjectMeta "status.sidecar.istio.io/port" .Values.global.proxy.statusPort) "0") }}
        - --statusPort

        - MUTUAL_TLS
        {{- else }}
        - --controlPlaneAuthPolicy
        - NONE
        {{- end }}
        - --dnsRefreshRate
        - {{ valueOrDefault .Values.global.proxy.dnsRefreshRate "300s" }}
      {{- if (ne (annotation .ObjectMeta "status.sidecar.istio.io/port" .Values.global.proxy.statusPort) "0") }}
        - --statusPort

        - MUTUAL_TLS
        {{- else }}
        - --controlPlaneAuthPolicy
        - NONE
        {{- end }}
        - --dnsRefreshRate
        - {{ valueOrDefault .Values.global.proxy.dnsRefreshRate "300s" }}
      {{- if (ne (annotation .ObjectMeta "status.sidecar.istio.io/port" .Values.global.proxy.statusPort) "0") }}
        - --statusPort

  # Wait until 99% of the proxies receive the distribution, timing out after 5 minutes
  istioctl experimental wait --for=distribution --threshold=.99 --timeout=300s virtualservice bookinfo.default
`,
		RunE: func(cmd *cobra.Command, args []string) error {
			if forFlag == "delete" {
				return errors.New("wait for delete is not yet implemented")
			} else if forFlag != "distribution" {

	// With the current rate-limiter in use (5ms*2^(maxRetries-1)) the following numbers represent the
	// sequence of delays between successive queuings of a service.
	//
	// 5ms, 10ms, 20ms, 40ms, 80ms, 160ms, 320ms, 640ms, 1.3s, 2.6s, 5.1s, 10.2s, 20.4s, 41s, 82s
	maxRetries     = 15
	controllerName = "service-cidr-controller"

	ServiceCIDRProtectionFinalizer = "networking.k8s.io/service-cidr-finalizer"

	// (e.g. '30s'). Must be greater than 0 to set.
	UDPTimeout metav1.Duration
	// udpStreamTimeout is how long an idle UDP conntrack entry in
	// ASSURED state will remain in the conntrack table
	// (e.g. '300s'). Must be greater than 0 to set.
	UDPStreamTimeout metav1.Duration
}

// KubeProxyWinkernelConfiguration contains Windows/HNS settings for
// the Kubernetes proxy server.