// Note the pod will be crashlooping, so this may take a few minutes to become fully functional based on when the retry occurs.
  // This requires no RBAC privilege, but will require the CNI agent to run as a privileged pod.
  bool repairPods = 11;

  // No longer used.
  string createEvents = 6 [deprecated = true];

}

type Tokenprivileges struct {
	PrivilegeCount uint32
	Privileges     [1]LUIDAndAttributes // Use AllPrivileges() for iterating.
}

// AllPrivileges returns a slice that can be used to iterate over the privileges in p.
func (p *Tokenprivileges) AllPrivileges() []LUIDAndAttributes {
	return (*[(1 << 27) - 1]LUIDAndAttributes)(unsafe.Pointer(&p.Privileges[0]))[:p.PrivilegeCount:p.PrivilegeCount]
}

name: {{ $key }} value: "{{ $value }}" {{- end }} resources: {{ toYaml .Values.global.proxy_init.resources | indent 4 }} {{- else }} resources: {} {{- end }} securityContext: allowPrivilegeEscala: {{ .Values.global.proxy.privileged }} privileged: {{ .Values.global.proxy.privileged }} capabilities: {{- if not .Values.istio_cni.enabled }} add: - NET_ADMIN - NET_RAW {{- end }} drop: - ALL {{- if not .Values.istio_cni.enabled }} readOnlyRootFilesyst: false runAsGroup: 0 runAsNonRoot: false runAsUser:...

}} {{- if .Values.global.proxy_init.resources }} resources: {{ toYaml .Values.global.proxy_init.resources | indent 4 }} {{- else }} resources: {} {{- end }} securityContext: allowPrivilegeEscala: {{ .Values.global.proxy.privileged }} privileged: {{ .Values.global.proxy.privileged }} capabilities: {{- if not .Values.istio_cni.enabled }} add: - NET_ADMIN - NET_RAW {{- end }} drop: - ALL {{- if not .Values.istio_cni.enabled }} readOnlyRootFilesyst: false runAsGroup: 0 runAsNonRoot: false runAsUser:...

        {{- end }}
      {{- end }}
        resources:
      {{ template "resources" . }}
        securityContext:
          allowPrivilegeEscalation: {{ .Values.global.proxy.privileged }}
          privileged: {{ .Values.global.proxy.privileged }}
          capabilities:
        {{- if not (or .Values.pilot.cni.enabled .Values.istio_cni.enabled) }}
            add:
            - NET_ADMIN
            - NET_RAW

        {{- end }}
      {{- end }}
        resources:
      {{ template "resources" . }}
        securityContext:
          allowPrivilegeEscalation: {{ .Values.global.proxy.privileged }}
          privileged: {{ .Values.global.proxy.privileged }}
          capabilities:
        {{- if not (or .Values.pilot.cni.enabled .Values.istio_cni.enabled) }}
            add:
            - NET_ADMIN
            - NET_RAW

        {{- end }}
      {{- end }}
        resources:
      {{ template "resources" . }}
        securityContext:
          allowPrivilegeEscalation: {{ .Values.global.proxy.privileged }}
          privileged: {{ .Values.global.proxy.privileged }}
          capabilities:
        {{- if not (or .Values.pilot.cni.enabled .Values.istio_cni.enabled) }}
            add:
            - NET_ADMIN
            - NET_RAW

        {{- end }}
      {{- end }}
        resources:
      {{ template "resources" . }}
        securityContext:
          allowPrivilegeEscalation: {{ .Values.global.proxy.privileged }}
          privileged: {{ .Values.global.proxy.privileged }}
          capabilities:
        {{- if not (or .Values.pilot.cni.enabled .Values.istio_cni.enabled) }}
            add:
            - NET_ADMIN
            - NET_RAW

        {{- end }}
      {{- end }}
        resources:
      {{ template "resources" . }}
        securityContext:
          allowPrivilegeEscalation: {{ .Values.global.proxy.privileged }}
          privileged: {{ .Values.global.proxy.privileged }}
          capabilities:
        {{- if not (or .Values.pilot.cni.enabled .Values.istio_cni.enabled) }}
            add:
            - NET_ADMIN
            - NET_RAW

}

func TestInboundListener_PrivilegedPorts(t *testing.T) {
	// Verify that an explicit ingress listener will not bind to privileged ports
	// if proxy is not using Iptables and cannot bind to privileged ports (1-1023).
	//
	// Even if a user explicitly created a Sidecar config with an ingress listener for a privileged port,
	// it is still not worth it creating such a listener if we already known that a proxy will end up
	// rejecting it.