The MIT License (MIT)

Copyright (c) 2016 Evan Huus
Copyright (c) 2023 Klaus Post

Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is

Copyright (c) 2012 The Go Authors. All rights reserved.
Copyright (c) 2019 Klaus Post. All rights reserved.

Redistribution and use in source and binary forms, with or without
modification, are permitted provided that the following conditions are
met:

   * Redistributions of source code must retain the above copyright
notice, this list of conditions and the following disclaimer.
   * Redistributions in binary form must reproduce the above

	"istio.io/istio/cni/pkg/nodeagent"
)

// newCNIClient is a unit test override variable for mocking.
var newCNIClient = buildClient

// An udsCore write entries to an UDS server with HTTP Post. Log messages will be encoded into a JSON array.
type CNIEventClient struct {
	client *http.Client
	url    string
}

func buildClient(address, path string) CNIEventClient {
	c := &http.Client{

        exec:
          command:
          - pilot-agent
          - request
          - --debug-port={{(annotation .ObjectMeta `status.sidecar.istio.io/port` .Values.global.proxy.statusPort)}}
          - POST
          - drain
  {{- end }}
    env:
    {{- if eq (env .InboundTrafficPolicyMode "localhost") "passthrough" }}
    - name: REWRITE_PROBE_LEGACY_LOCALHOST_DESTINATION
      value: "true"
    {{- end }}

        exec:
          command:
          - pilot-agent
          - request
          - --debug-port={{(annotation .ObjectMeta `status.sidecar.istio.io/port` .Values.global.proxy.statusPort)}}
          - POST
          - drain
  {{- end }}
    env:
    {{- if eq (env .InboundTrafficPolicyMode "localhost") "passthrough" }}
    - name: REWRITE_PROBE_LEGACY_LOCALHOST_DESTINATION
      value: "true"
    {{- end }}

  // Name must be an IANA_SVC_NAME.
  optional k8s.io.apimachinery.pkg.util.intstr.IntOrString port = 2;

  // Host name to connect to, defaults to the pod IP. You probably want to set
  // "Host" in httpHeaders instead.
  // +optional
  optional string host = 3;

  // Scheme to use for connecting to the host.
  // Defaults to HTTP.
  // +optional
  optional string scheme = 4;

  // requirements.
  // +optional
  optional string nodeName = 10;

  // Host networking requested for this carp. Use the host's network namespace.
  // If this option is set, the ports that will be used must be specified.
  // Default to false.
  // +k8s:conversion-gen=false
  // +optional
  optional bool hostNetwork = 11;

  // Use the host's pid namespace.
  // Optional: Default to false.
  // +k8s:conversion-gen=false

        as described in Section 3.1, and You must inform recipients of the
        Executable Form how they can obtain a copy of such Source Code Form by
        reasonable means in a timely manner, at a charge no more than the cost
        of distribution to the recipient; and

     b. You may distribute such Executable Form under the terms of this License,
        or sublicense it under different terms, provided that the license for

	// within all pods as we do on the host.
	//
	// This should be fine, as the host binaries are all we have to work with here anyway,
	// as we are running within a privileged container - and we don't want to take the time to
	// redetect for each pod anyway.
	//
	// Extreme corner case:
	// If for some reason your host had both binaries, and you were injecting out-of-band

      containers:
        - name: istio-operator
          image: {{.Values.hub}}/operator:{{.Values.tag}}
          command:
          - operator
          - server
          - --monitoring-host={{ .Values.operator.monitoring.host }}
          - --monitoring-port={{ .Values.operator.monitoring.port }}
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop: