meshConfig:
  defaultConfig:
    gatewayTopology:
      numTrustedProxies: 1 # Needed for X-Forwarded-For (See https://istio.io/latest/docs/ops/configuration/traffic-management/network-topologies/)
`
			} else {
				cfg.ControlPlaneValues = `
values:
  pilot: 
    env: 
      PILOT_JWT_ENABLE_REMOTE_JWKS: true
      ISTIO_DUAL_STACK: true
      ENABLE_SELECTOR_BASED_K8S_GATEWAY_POLICY: false

      PILOT_JWT_ENABLE_REMOTE_JWKS: true
meshConfig:
  defaultConfig:
    gatewayTopology:
      numTrustedProxies: 1 # Needed for X-Forwarded-For (See https://istio.io/latest/docs/ops/configuration/traffic-management/network-topologies/)
`
		})).
		// Create namespaces first. This way, echo can correctly configure egress to all namespaces.
		SetupParallel(
			namespace.Setup(&echo1NS, namespace.Config{Prefix: "echo1", Inject: true}),

func validateAllowedTopologies(topologies []api.TopologySelectorTerm, fldPath *field.Path) field.ErrorList {
	allErrs := field.ErrorList{}

	if len(topologies) == 0 {
		return allErrs
	}

	rawTopologies := make([]map[string]sets.Set[string], len(topologies))
	for i, term := range topologies {
		idxPath := fldPath.Index(i)

	MetadataValue(key string) string

	// ProxyKubectlOnly returns a boolean value to indicate whether all traffic
	// should route through the HTTP proxy or only Kubectl traffic. (Useful
	// in topologies where the API server is private but the ingress is public).
	ProxyKubectlOnly() bool

	TopologyPairToPodCounts map[topologyPair]*int64
	// TopologyNormalizingWeight is the weight we give to the counts per topology.
	// This allows the pod counts of smaller topologies to not be watered down by
	// bigger ones.
	TopologyNormalizingWeight []float64
}

// Clone implements the mandatory Clone interface. We don't really copy the data since
// there is no need for that.

## Authentication

The agent supports two forms of authentication with the CA/discovery servers: mTLS and JWT. Varying deployment
topologies mix and match these two.

For a standard Kubernetes deployment, both CA and discovery will use JWT authentication, with a token automatically

	if !ok {
		return nil, fmt.Errorf("%+v convert to podtopologyspread.preFilterState error", c)
	}
	return s, nil
}

// calPreFilterState computes preFilterState describing how pods are spread on topologies.
func (pl *PodTopologySpread) calPreFilterState(ctx context.Context, pod *v1.Pod) (*preFilterState, error) {
	constraints, err := pl.getConstraints(pod)
	if err != nil {

			// representation. This one was created following the these concepts:
			// 1. be internally consistent (most important rule)
			// 2. be as close as possible as existing HW topologies
			// 3. if possible, minimize chances wrt existing HW topologies.
			name: "DualNumaMultiSocketPerNumaHT",
			machineInfo: cadvisorapi.MachineInfo{
				NumCores:   80,
				NumSockets: 4,
				Topology: []cadvisorapi.Node{
					{Id: 0,

		// to not leave such pods in pending state forever, we check that if no other pod
		// in the cluster matches the namespace and selector of this pod, the pod matches
		// its own terms, and the node has all the requested topologies, then we allow the pod
		// to pass the affinity check.
		if len(state.affinityCounts) == 0 && podMatchesAllAffinityTerms(state.podInfo.RequiredAffinityTerms, state.podInfo.Pod) {
			return true
		}
		return false

		{Event: framework.ClusterEvent{Resource: framework.PersistentVolume, ActionType: framework.Add | framework.Update}},
		// Pods may fail to find available PVs because the node labels do not
		// match the storage class's allowed topologies or PV's node affinity.
		// A new or updated node may make pods schedulable.
		//
		// A note about UpdateNodeTaint event:
		// NodeAdd QueueingHint isn't always called because of the internal feature called preCheck.