OneOf: value,
		},
	}

	paths := make([]*matcher.MetadataMatcher_PathSegment, 0, len(keys))
	for _, k := range keys {
		paths = append(paths, &matcher.MetadataMatcher_PathSegment{
			Segment: &matcher.MetadataMatcher_PathSegment_Key{
				Key: k,
			},
		})
	}

	out := &matcher.MetadataMatcher{
		Filter: filter,
		Path:   paths,
	}
	if useExtendedJwt {
		out.Value = &matcher.ValueMatcher{

	// File reads the given files and calls YAML.
	File(ns string, paths ...string) Plan

	// Eval the same as YAML, but it evaluates the template parameters.
	Eval(ns string, args any, yamlText ...string) Plan

	// EvalFile the same as File, but it evaluates the template parameters.
	EvalFile(ns string, args any, paths ...string) Plan

	// OutputPaths is a list of file system paths to write the log data to.
	// The special values stdout and stderr can be used to output to the
	// standard I/O streams. This defaults to stdout.
	OutputPaths []string

	// ErrorOutputPaths is a list of file system paths to write logger errors to.
	// The special values stdout and stderr can be used to output to the
	// standard I/O streams. This defaults to stderr.
	ErrorOutputPaths []string

// performance critical code paths, using Unbounded is strongly discouraged and
// defining a new type specific implementation of this buffer is preferred. See
// internal/transport/transport.go for an example of this.
type Unbounded[T any] struct {
	c       chan T
	mu      sync.Mutex
	backlog []T
}

// NewUnbounded returns a new instance of Unbounded.
func NewUnbounded[T any]() *Unbounded[T] {

			Gateways: []string{fmt.Sprintf("%s/%s-%s-%s", IngressNamespace, ingress.Name, constants.IstioIngressGatewayName, ingress.Namespace)},
		}

		httpRoutes := make([]*networking.HTTPRoute, 0, len(rule.HTTP.Paths))
		for _, httpPath := range rule.HTTP.Paths {
			httpMatch := &networking.HTTPMatchRequest{}
			if httpPath.PathType != nil {
				switch *httpPath.PathType {
				case knetworking.PathTypeExact:
					httpMatch.Uri = &networking.StringMatch{

	clusterConfigs configsVal
)

// NewSettingsFromCommandLine returns Settings obtained from command-line flags.
// config.Parse must be called before calling this function.
func NewSettingsFromCommandLine() (*Settings, error) {
	if !config.Parsed() {
		panic("config.Parse must be called before this function")
	}

	s := settingsFromCommandLine.clone()

	// Process the kube clusterConfigs.
	var err error

//     certificates from Gateway/DestinationRule can also be served. This is done by parsing resource
//     names in accordance with security.SdsCertificateConfig (file-cert: and file-root:).
//   - On demand CSRs. This is used only for the `default` certificate. When this resource is
//     requested, a CSR will be sent to the configured caClient.
//

			v:    val("private-repo/istio", "1.12-this-is-unusual-tag"),
			want: "private-repo/istio/proxyv2:1.12-this-is-unusual-tag",
		},
		{
			desc: "unusual tag should work, default override",
			v:    val("private-repo/istio", "1.12-this-is-unusual-tag-distroless"),
			pc:   pc("default"),
			want: "private-repo/istio/proxyv2:1.12-this-is-unusual-tag",
		},
		{

// from the provided k8s config files.
type ClientFactoryFunc func(kubeConfigs []string) ([]istioKube.CLIClient, error)

// Settings provide kube-specific Settings from flags.
type Settings struct {
	// An array of paths to kube config files. Required if the environment is kubernetes.
	KubeConfig []string

	// Indicates that the LoadBalancer services can obtain a public IP. If not, NodePort be used as a workaround

			a.Security.SecretRotationGracePeriodRatio = 1
			return a
		})
		// We start the agent, but never send a single SDS request
		// This behavior is useful for supporting writing the certs to disk without Envoy
		checkCertsWritten(t, dir)

		// TODO: this does not actually work, rotation is tied to SDS currently
		// expectFileChanged(t, filepath.Join(dir, "cert-chain.pem"))