for code := range envoytypev3.StatusCode_name {
		supported = append(supported, int(code))
	}
	sort.Ints(supported)
	return supported
}()

type builtExtAuthz struct {
	http *extauthzhttp.ExtAuthz
	tcp  *extauthztcp.ExtAuthz
	err  error
}

func processExtensionProvider(push *model.PushContext) map[string]*builtExtAuthz {
	resolved := map[string]*builtExtAuthz{}
	for i, config := range push.Mesh.ExtensionProviders {

ARG BASE_VERSION=latest
ARG ISTIO_BASE_REGISTRY=gcr.io/istio-release

FROM ${ISTIO_BASE_REGISTRY}/base:${BASE_VERSION}

ARG TARGETARCH
COPY ${TARGETARCH:-amd64}/extauthz /usr/local/bin/extauthz

      value:
        name: envoy.filters.http.ext_authz
        typed_config:
          "@type": type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthz
          grpc_service:
            envoy_grpc:
              cluster_name: acme-ext-authz
            initial_metadata:
            - key: foo
              value: myauth.acme # required by local ext auth server.

name: envoy.filters.network.ext_authz
typedConfig:
  '@type': type.googleapis.com/envoy.extensions.filters.network.ext_authz.v3.ExtAuthz
  failureModeAllow: true
  filterEnabledMetadata:
    filter: envoy.filters.network.rbac
    path:
    - key: istio_ext_authz_shadow_effective_policy_id
    value:
      stringMatch:
        prefix: istio-ext-authz
  grpcService:
    envoyGrpc:
      authority: my-custom-ext-authz.foo.svc.cluster.local

name: envoy.filters.http.ext_authz
typedConfig:
  '@type': type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthz
  failureModeAllow: true
  filterEnabledMetadata:
    filter: envoy.filters.http.rbac
    path:
    - key: istio_ext_authz_shadow_effective_policy_id
    value:
      stringMatch:
        prefix: istio-ext-authz
  grpcService:
    envoyGrpc:
      authority: my-custom-ext-authz.foo.svc.cluster.local

name: envoy.filters.http.ext_authz
typedConfig:
  '@type': type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthz
  failureModeAllow: true
  filterEnabledMetadata:
    filter: envoy.filters.http.rbac
    path:
    - key: istio_ext_authz_shadow_effective_policy_id
    value:
      stringMatch:
        prefix: istio-ext-authz
  grpcService:
    envoyGrpc:
      authority: my-custom-ext-authz.foo.svc.cluster.local

  files:
  - tests/testdata/certs
  targets:
  - ${TARGET_OUT_LINUX}/client
  - ${TARGET_OUT_LINUX}/server

# Sample authz server
- name: ext-authz
  dockerfile: samples/extauthz/docker/Dockerfile
  targets:
    - ${TARGET_OUT_LINUX}/extauthz

# TODO(https://github.com/istio/istio/issues/38224)
- name: app_sidecar_rockylinux_9
  dockerfile: pkg/test/echo/docker/Dockerfile.app_sidecar_centos_8
  files:

name: envoy.filters.http.ext_authz
typedConfig:
  '@type': type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthz
  failureModeAllow: true
  filterEnabledMetadata:
    filter: envoy.filters.http.rbac
    path:
    - key: istio_ext_authz_shadow_effective_policy_id
    value:
      stringMatch:
        prefix: istio-ext-authz
  grpcService:
    envoyGrpc:
      authority: my-custom-ext-authz.foo.svc.cluster.local

		}
		return []*hcm.HttpFilter{
			{
				Name:       wellknown.HTTPRoleBasedAccessControl,
				ConfigType: &hcm.HttpFilter_TypedConfig{TypedConfig: protoconv.MessageToAny(rbac)},
			},
		}
	}

	extauthz, err := getExtAuthz(b.extensions, providers)
	if err != nil {
		b.logger.AppendError(multierror.Prefix(err, "failed to process CUSTOM action, will generate deny configs for the specified rules:"))

name: envoy.filters.http.ext_authz
typedConfig:
  '@type': type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthz
  failureModeAllow: true
  filterEnabledMetadata:
    filter: envoy.filters.http.rbac
    path:
    - key: istio_ext_authz_shadow_effective_policy_id
    value:
      stringMatch:
        prefix: istio-ext-authz
  grpcService:
    envoyGrpc:
      authority: my-custom-ext-authz.foo.svc.cluster.local