// the default for log messages should be stderr, not stdout
			root := c.Root()
			if root != nil {
				_ = c.Root().PersistentFlags().Set("log_target", "stderr")
			}
			if c.Parent() != nil && c.Parent().PersistentPreRunE != nil {
				return c.Parent().PersistentPreRunE(c, args)
			}

			return nil
		},
	}

	injectCmd.PersistentFlags().StringVar(&meshConfigFile, "meshConfigFile", "",

message IPAddressSpec {
  // ParentRef references the resource that an IPAddress is attached to.
  // An IPAddress must reference a parent object.
  // +required
  optional ParentReference parentRef = 1;
}

// ParentReference describes a reference to a parent object.
message ParentReference {
  // Group is the group of the object being referenced.
  // +optional
  optional string group = 1;

	return cniConfigFilepath, nil
}

// If configured as chained CNI plugin, waits indefinitely for a main CNI config file to exist before returning
// Or until cancelled by parent context
func getCNIConfigFilepath(ctx context.Context, cfg pluginConfig) (string, error) {
	filename := cfg.cniConfName

	if !cfg.chainedCNIPlugin {
		if len(filename) == 0 {
			filename = "YYY-istio-cni.conf"

  // Note the following deviations from the "host" part of the
  // URI as defined in RFC 3986:
  // 1. IPs are not allowed. Currently an IngressRuleValue can only apply to
  //    the IP in the Spec of the parent Ingress.
  // 2. The `:` delimiter is not respected because ports are not allowed.
  // 	  Currently the port of an Ingress is implicitly :80 for http and
  // 	  :443 for https.
  // Both these may change in the future.

  // Note the following deviations from the "host" part of the
  // URI as defined in RFC 3986:
  // 1. IPs are not allowed. Currently an IngressRuleValue can only apply to
  //    the IP in the Spec of the parent Ingress.
  // 2. The `:` delimiter is not respected because ports are not allowed.
  // 	  Currently the port of an Ingress is implicitly :80 for http and
  // 	  :443 for https.
  // Both these may change in the future.

  // Namespace API objects are cluster-scoped.
  // "Namespaced" means that only namespaced resources will match this rule.
  // "*" means that there are no scope restrictions.
  // Subresources match the scope of their parent resource.
  // Default is "*".
  //
  // +optional
  optional string scope = 4;
}

// RuleWithOperations is a tuple of Operations and Resources. It is recommended to make

  // This value will be null if an APIService reports subresources but supports no operations on the parent resource
  optional k8s.io.apimachinery.pkg.apis.meta.v1.GroupVersionKind responseKind = 2;

  // scope indicates the scope of a resource, either Cluster or Namespaced
  optional string scope = 3;

  {{- end }}
  {{- if .Values.global.logAsJson }}
    - --log_as_json
  {{- end }}
    lifecycle:
      postStart:
        exec:
          command:
          - pilot-agent
          - wait
          - --url=http://localhost:15020/healthz/ready
    env:
    - name: ISTIO_META_GENERATOR
      value: grpc
    - name: OUTPUT_CERTS
      value: /var/lib/istio/data

      Work and such Derivative Works in Source or Object form.

   3. Grant of Patent License. Subject to the terms and conditions of
      this License, each Contributor hereby grants to You a perpetual,
      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
      (except as stated in this section) patent license to make, have made,
      use, offer to sell, sell, import, and otherwise transfer the Work,

      Work and such Derivative Works in Source or Object form.

   3. Grant of Patent License. Subject to the terms and conditions of
      this License, each Contributor hereby grants to You a perpetual,
      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
      (except as stated in this section) patent license to make, have made,
      use, offer to sell, sell, import, and otherwise transfer the Work,