proxyMetadata:
          # this should override the value from the global meshconfig
          PROXY_CONFIG_ANNOT_VALUE: bar
    labels: {}
  template:
    ports: {}
    serviceAccount: vm-serviceaccount
  probe:
    httpGet:

ISTIO_META_MESH_ID=''
ISTIO_META_NETWORK=''
ISTIO_META_WORKLOAD_NAME='foo'
ISTIO_NAMESPACE='bar'
ISTIO_SERVICE='foo.bar'
ISTIO_SERVICE_CIDR='*'
ISTIO_SVC_IP='10.10.10.10'
POD_NAMESPACE='bar'
SERVICE_ACCOUNT='vm-serviceaccount'

ISTIO_META_NETWORK=''
ISTIO_META_WORKLOAD_NAME='foo'
ISTIO_NAMESPACE='bar'
ISTIO_SERVICE='foo.bar'
ISTIO_SERVICE_CIDR='*'
ISTIO_SVC_IP='fd00:10:96::1'
POD_NAMESPACE='bar'
PROXY_CONFIG_ANNOT_VALUE='bar'
SERVICE_ACCOUNT='vm-serviceaccount'

    ISTIO_META_NETWORK: ""
    ISTIO_META_WORKLOAD_NAME: foo
    ISTIO_METAJSON_LABELS: '{"service.istio.io/canonical-name":"foo","service.istio.io/canonical-revision":"latest"}'
    POD_NAMESPACE: bar
    SERVICE_ACCOUNT: vm-serviceaccount
    TRUST_DOMAIN: ""
  readinessProbe:
    httpGet:

// TestWorkloadEntryConfigure enumerates test cases based on subdirectories of testdata/vmconfig.
// Each subdirectory contains two input files: workloadgroup.yaml and meshconfig.yaml that are used
// to generate golden outputs from the VM command.
func TestWorkloadEntryConfigure(t *testing.T) {
	noClusterID := "failed to automatically determine the --clusterID"
	files, err := os.ReadDir("testdata/vmconfig")
	if err != nil {
		t.Fatal(err)
	}

kind: WorkloadGroup
metadata:
  name: foo
  namespace: bar
spec:
  metadata:
    annotations: {}
    labels: {}
  template:
    ports: {}
    serviceAccount: vm-serviceaccount
  probe:
    httpGet:

        proxyMetadata:
          # this should override the value from the global meshconfig
          PROXY_CONFIG_ANNOT_VALUE: bar
    labels: {}
  template:
    ports: {}
    serviceAccount: vm-serviceaccount
  probe:
    httpGet:

              "name": "istio.metadata_exchange",
              "typed_config": {
               "@type": "type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm",
               "config": {
                "vm_config": {
                 "runtime": "envoy.wasm.runtime.null",
                 "code": {
                  "local": {
                   "inline_string": "envoy.wasm.metadata_exchange"
                  }

For VMs, the standard flow is for the user to provision a short-lived JWT token onto the VM. After the initial
CSR, certificates are written to disk and mTLS is used for future requests. If the VM restarted, it would continue
to use the certificates written to disk, assuming the downtime is less than certificate expiration. This is why

    # Override to pass env variables, for example: /inject/cluster/remote/net/network2
    injectionPath: "/inject"

    injectionCABundle: ""
  telemetry:
    enabled: true
    v2:
      # For Null VM case now.
      # This also enables metadata exchange.
      enabled: true
      # Indicate if prometheus stats filter is enabled or not
      prometheus:
        enabled: true
      # stackdriver filter settings.