appfiles -> appwp
  appfiles -> ig
  appfiles -> nwc
  ztunchart[label="ztunnel",class="helm"]
  ztunnel -> ztunchart -> ztunnelds
  istiodchart[label="istiod",class="helm"]
  cpt -> istiodchart
  istiodchart -> istiod18
  istiodchart -> istiod19
  cnichart[label="cni",class="helm"]
  cni -> cnichart -> cnids
  istiogh[label="istio github"]
  extras -> istiogh -> extrads
  tagchart[label="tag*"]
  edge[weight=1]

		name    string
		input   map[string]*discovery.DiscoveryResponse
		want    string
		wantErr bool
	}{
		{
			name: "prints multiple istiod inputs to buffer in alphabetical order by pod name",
			input: map[string]*discovery.DiscoveryResponse{
				"istiod1": xdsResponseInput("istiod1", []clientConfigInput{
					{
						proxyID:        "proxy1",
						clusterID:      "cluster1",
						version:        "1.20",

NAME       CLUSTER      CDS          LDS         EDS         RDS          ECDS         ISTIOD      VERSION
proxy1     cluster1     STALE        SYNCED      SYNCED      NOT SENT     SYNCED       istiod1     1.20
proxy2     cluster2     STALE        SYNCED      STALE       SYNCED       STALE        istiod2     1.19
proxy3     cluster3     NOT SENT     ERROR       STALE       NOT SENT     NOT SENT     istiod3     1.20

				istiodID:              cp.ID,
				istiodVersion:         meta.IstioVersion,
				clusterStatus:         cds,
				listenerStatus:        lds,
				routeStatus:           rds,
				endpointStatus:        eds,
				extensionconfigStatus: ecds,
			})
			if len(fullStatus) == 0 {
				return nil, nil, fmt.Errorf("no proxies found (checked %d istiods)", len(drs))
			}

{{ $vals = set $vals "pilot" $pilotVals -}}
{{ $vals | toPrettyJson | indent 4 }}

  # To disable injection: use omitSidecarInjectorConfigMap, which disables the webhook patching
  # and istiod webhook functionality.
  #
  # New fields should not use Values - it is a 'primary' config object, users should be able
  # to fine tune it or use it with kube-inject.
  config: |-

{{ $vals = set $vals "pilot" $pilotVals -}}
{{ $vals | toPrettyJson | indent 4 }}

  # To disable injection: use omitSidecarInjectorConfigMap, which disables the webhook patching
  # and istiod webhook functionality.
  #
  # New fields should not use Values - it is a 'primary' config object, users should be able
  # to fine tune it or use it with kube-inject.
  config: |-

apiVersion: release-notes/v2
kind: feature
area: installation
issue: []
releaseNotes:
- |

NAME       CLUSTER      CDS       LDS        EDS        RDS          ECDS         ISTIOD      VERSION
proxy1     cluster1     STALE     SYNCED     SYNCED     NOT SENT     NOT SENT     istiod1     1.20

apiVersion: release-notes/v2
kind: feature
area: installation
issue: []
releaseNotes:
- |

		}
	}

	s.caServer.Register(grpc)

	log.Info("Istiod CA has started")
}

// detectAuthEnv will use the JWT token that is mounted in istiod to set the default audience
// and trust domain for Istiod, if not explicitly defined.
// K8S will use the same kind of tokens for the pods, and the value in istiod's own token is
// simplest and safest way to have things match.
//