valueFrom:
                resourceFieldRef:
                  resource: limits.cpu
            - name: PROXY_CONFIG
              value: |
                     {{ protoToJSON .ProxyConfig }}
            {{- if .ProxyConfig.ProxyMetadata }}
            {{- range $key, $value := .ProxyConfig.ProxyMetadata }}
            - name: {{ $key }}
              value: "{{ $value }}"
            {{- end }}

			}

			secOpts, err := options.NewSecurityOptions(proxyConfig, proxyArgs.StsPort, proxyArgs.TokenManagerPlugin)
			if err != nil {
				return err
			}

			// If we are using a custom template file (for control plane proxy, for example), configure this.
			if proxyArgs.TemplateFile != "" && proxyConfig.CustomConfigFile == "" {
				proxyConfig.ProxyBootstrapTemplatePath = proxyArgs.TemplateFile
			}

// health checking for VMs and DNS proxying).
func NewAgent(proxyConfig *mesh.ProxyConfig, agentOpts *AgentOptions, sopts *security.Options, eopts envoy.ProxyConfig) *Agent {
	return &Agent{
		proxyConfig: proxyConfig,
		cfg:         agentOpts,
		secOpts:     sopts,
		envoyOpts:   eopts,
		fileWatcher: filewatcher.NewWatcher(),
	}
}

		RootCertFilePath:               security.DefaultRootCertFilePath,
	}

	o, err := SetupSecurityOptions(proxyConfig, o, jwtPolicy.Get(),
		credFetcherTypeEnv, credIdentityProvider)
	if err != nil {
		return o, err
	}

	return o, err
}

func SetupSecurityOptions(proxyConfig *meshconfig.ProxyConfig, secOpt *security.Options, jwtPolicy,
	credFetcherTypeEnv, credIdentityProvider string,
) (*security.Options, error) {

			a.Security.KeyFilePath = cfg.PrivateKeyPath
			a.Security.RootCertFilePath = cfg.CaCertificatePath
			a.ProxyConfig.ProxyMetadata = map[string]string{}
			a.ProxyConfig.ProxyMetadata[MetadataClientCertChain] = filepath.Join(dir, "cert-chain.pem")
			a.ProxyConfig.ProxyMetadata[MetadataClientCertKey] = filepath.Join(dir, "key.pem")
			a.ProxyConfig.ProxyMetadata[MetadataClientRootCert] = filepath.Join(dir, "root-cert.pem")
			a.Security.FileMountedCerts = true

              valueFrom:
                resourceFieldRef:
                  resource: limits.cpu
            - name: PROXY_CONFIG
              value: |
                     {{ protoToJSON .ProxyConfig }}
            {{- if .ProxyConfig.ProxyMetadata }}
            {{- range $key, $value := .ProxyConfig.ProxyMetadata }}
            - name: {{ $key }}
              value: "{{ $value }}"
            {{- end }}

              valueFrom:
                resourceFieldRef:
                  resource: limits.cpu
            - name: PROXY_CONFIG
              value: |
                     {{ protoToJSON .ProxyConfig }}
            {{- if .ProxyConfig.ProxyMetadata }}
            {{- range $key, $value := .ProxyConfig.ProxyMetadata }}
            - name: {{ $key }}
              value: "{{ $value }}"
            {{- end }}

              valueFrom:
                resourceFieldRef:
                  resource: limits.cpu
            - name: PROXY_CONFIG
              value: |
                     {{ protoToJSON .ProxyConfig }}
            {{- if .ProxyConfig.ProxyMetadata }}
            {{- range $key, $value := .ProxyConfig.ProxyMetadata }}
            - name: {{ $key }}
              value: "{{ $value }}"
            {{- end }}

              valueFrom:
                resourceFieldRef:
                  resource: limits.cpu
            - name: PROXY_CONFIG
              value: |
                     {{ protoToJSON .ProxyConfig }}
            {{- if .ProxyConfig.ProxyMetadata }}
            {{- range $key, $value := .ProxyConfig.ProxyMetadata }}
            - name: {{ $key }}
              value: "{{ $value }}"
            {{- end }}

              valueFrom:
                resourceFieldRef:
                  resource: limits.cpu
            - name: PROXY_CONFIG
              value: |
                     {{ protoToJSON .ProxyConfig }}
            {{- if .ProxyConfig.ProxyMetadata }}
            {{- range $key, $value := .ProxyConfig.ProxyMetadata }}
            - name: {{ $key }}
              value: "{{ $value }}"
            {{- end }}