"ambient_enabled": %t,
    "kubernetes": {
        "k8s_api_root": "APIRoot",
        "kubeconfig": "testK8sConfig",
		"intercept_type": "%s",
        "node_name": "testNodeName",
        "exclude_namespaces": ["testExcludeNS"],
        "cni_bin_dir": "/testDirectory"
    }
}`

type mockInterceptRuleMgr struct {
	lastRedirect []*Redirect
}

		},
		config.KV{
			Key:   Extensions,
			Value: DefaultExtensions,
		},
		config.KV{
			Key:   MimeTypes,
			Value: DefaultMimeTypes,
		},
	}
)

// Parses the given compression exclude list `extensions` or `content-types`.
func parseCompressIncludes(include string) ([]string, error) {
	includes := strings.Split(include, config.ValueSeparator)
	for _, e := range includes {
		if len(e) == 0 {

		// Matched an extension to compress, do not exclude.
		return false
	}

	if len(cfg.MimeTypes) > 0 && hasPattern(cfg.MimeTypes, contentType) {
		// Matched an MIME type to compress, do not exclude.
		return false
	}

	// Did not match any inclusion filters, exclude from compression.
	return true
}

// Utility which returns if a string is present in the list.

	cniNetworkConfig     = `{
  "cniVersion": "0.3.1",
  "type": "istio-cni",
  "log_level": "info",
  "kubernetes": {
      "kubeconfig": "__KUBECONFIG_FILEPATH__",
      "cni_bin_dir": "/opt/cni/bin",
      "exclude_namespaces": [ "istio-system" ]
  }
}
`
)

func getEnv(key, fallback string) string {
	if value, ok := os.LookupEnv(key); ok {
		return value
	}
	return fallback
}

			},
			proxyEnv: []corev1.EnvVar{},
			golden:   filepath.Join(env.IstioSrc, "cni/pkg/plugin/testdata/include-exclude-ip.txt.golden"),
		},
		{
			name: "include-exclude-ports",
			annotations: map[string]string{
				annotation.SidecarStatus.Name:                      "true",
				annotation.SidecarTrafficIncludeInboundPorts.Name:  "1111,2222",
				annotation.SidecarTrafficExcludeInboundPorts.Name:  "3333,4444",

}

/// mostly copy pasted from spire below:

// regexes listed here have to exclusively match a cgroup path
// the regexes must include two named groups "poduid" and "containerid"
// if the regex needs to exclude certain substrings, the "mustnotmatch" group can be used
// nolint: lll
var cgroupREs = []*regexp.Regexp{
	// the regex used to parse out the pod UID and container ID from a

		"ISTIO_INBOUND_PORTS":       portBehavior,
		"ISTIO_NAMESPACE":           wg.Namespace,
		"ISTIO_SERVICE":             fmt.Sprintf("%s.%s", wg.Name, wg.Namespace),
		"ISTIO_SERVICE_CIDR":        "*",
		"ISTIO_LOCAL_EXCLUDE_PORTS": excludePorts,
		"SERVICE_ACCOUNT":           we.ServiceAccount,
	}

	if isRevisioned(revision) {
		overrides["CA_ADDR"] = IstiodAddr(istioNamespace, revision)
	}
	if len(internalIP) > 0 {

	ISTIOINIT  = "istio-init"
	ISTIOPROXY = "istio-proxy"
)

// Kubernetes a K8s specific struct to hold config
type Kubernetes struct {
	Kubeconfig        string   `json:"kubeconfig"`
	ExcludeNamespaces []string `json:"exclude_namespaces"`
}

// Config is whatever you expect your configuration json to be. This is whatever
// is passed in on stdin. Your plugin may wish to expose its functionality via

	for _, s := range helmreconciler.PrunedResourcesSchemas() {
		remainedObjs := objs.kind(s.Kind)
		if remainedObjs.size() == 0 {
			continue
		}
		for _, v := range remainedObjs.objMap {
			// exclude operator objects, which will not be pruned
			if strings.Contains(v.Name, "istio-operator") {
				continue
			}
			t.Fatalf("obj %s/%s is not pruned", v.Namespace, v.Name)
		}
	}
}

	for i, b := range h.QueuedBuckets {
		if b == bucket {
			// Delete...
			h.QueuedBuckets = append(h.QueuedBuckets[:i], h.QueuedBuckets[i+1:]...)
		}
	}
}

// setQueuedBuckets will add buckets, but exclude any that is already in h.HealedBuckets.
// Order is preserved.
func (h *healingTracker) setQueuedBuckets(buckets []BucketInfo) {
	h.mu.Lock()
	defer h.mu.Unlock()

	s := set.CreateStringSet(h.HealedBuckets...)