digraph { envoy -> sds [dir=both, label="SDS"] envoy -> xdsproxy [dir=both, label="ADS"] sds -> ca [label="CSR"] xdsproxy -> discovery [dir=both,label="ADS"] envoy [shape=hexagon, color=purple] subgraph cluster_istioagent { label = "Istio Agent" color="orange" sds xdsproxy } subgraph cluster_istiod { label = "Istiod" color="lightblue" ca discovery } }...

digraph { grpc -> ca [label="Send CSR gRPC Request"] subgraph cluster_istioagent { label = "Istio Agent" color="orange" sds SecretManager -> caClient [label="Sign CSR"] caClient -> grpc grpc -> TokenProvider [dir=none,label="Fetch JWT",color=purple] grpc -> cfiles [dir=none,label="Fetch Cert",color=purple] sds -> SecretManager [label="Generate certificate"] SecretManager -> cfiles [label="Write certs to file"] cfiles [label="Certificate Files"] grpc [shape=diamond] } subgraph cluster_istiod {...

			existingConfFiles: map[string]string{"istio-cni.conf": "istio-cni.conf"},
		},
	}

	for _, c := range cases {
		t.Run(c.name, func(t *testing.T) {
			// Create temp directory for files
			tempDir := t.TempDir()

			// Create existing config files if specified in test case
			for srcFilename, targetFilename := range c.existingConfFiles {

change which control plane revision handles injection, it's possible to create a revision tag "prod" and label our
namespace "istio.io/rev=prod". The "prod" revision tag could point to "1-7-6" initially and then be changed to point to "1-8-1"
at some later point.

nodeSelectorTerms: - matchExpressions: {{- if .global.arch }} - key: kubernetes.io/arch operator: In values: {{- range $key, $val := .global.arch }} {{- if gt ($val | int) 0 }} - {{ $key | quote }} {{- end }} {{- end }} {{- end }} {{- range $key, $val := $nodeSelector }} - key: {{ $key }} operator: In values: - {{ $val | quote }} {{- end }} {{- end }} {{- end }} {{- define "nodeAffinityPreferre" }} {{- range $key, $val := .global.arch }} {{- if gt ($val | int) 0 }} - weight: {{ $val | int }} preference: matchExpressions:...

func forEachInpodMarkIPRule(cfg *Config, f func(*netlink.Rule) error) error {
	var rules []*netlink.Rule
	families := []int{unix.AF_INET}
	if cfg.EnableIPv6 {
		families = append(families, unix.AF_INET6)
	}
	for _, family := range families {
		// Equiv:
		// ip rule add fwmark 0x111/0xfff pref 32764 lookup 100
		//
		// Adds in-pod rules for marking packets with the istio-specific TPROXY mark.
		// A very similar mechanism is used for sidecar TPROXY.

      value: |
             {{ protoToJSON .ProxyConfig }}
    - name: ISTIO_META_POD_PORTS
      value: |-
        [
        {{- $first := true }}
        {{- range $index1, $c := .Spec.Containers }}
          {{- range $index2, $p := $c.Ports }}
            {{- if (structToJSON $p) }}
            {{if not $first}},{{end}}{{ structToJSON $p }}
            {{- $first = false }}
            {{- end }}

	for _, l := range listenerDump.DynamicListeners {
		// If a listener was reloaded, it would contain both the active and draining state
		// delete the draining state for proper comparison
		l.DrainingState = nil
		if l.ActiveState != nil {
			dal = append(dal, l)
		}
	}

	// Support v2 or v3 in config dump. See ads.go:RequestedTypes for more info.
	for i := range dal {

		inputFile   string
		wantErr     bool
	}{
		{
			name:        "errors if unable to unmarshal bytes",
			inputFile:   "",
			wantConfigs: 0,
			wantErr:     true,
		},
	}
	for _, tt := range tests {
		t.Run(tt.name, func(t *testing.T) {
			cw := &ConfigWriter{}
			cd, _ := os.ReadFile(tt.inputFile)
			err := cw.Prime(cd)
			if cw.configDump == nil {
				if tt.wantConfigs != 0 {

				defer ticker.Stop()
				for range ticker.C {
					programmed := false
					gwc, err := kubeClient.GatewayAPI().GatewayV1().Gateways(ctx.NamespaceOrDefault(ctx.Namespace())).Get(context.TODO(), gw.Name, metav1.GetOptions{})
					if err == nil {
						// Check if gateway has Programmed condition set to true
						for _, cond := range gwc.Status.Conditions {