subjectAltName=@san
[ san ]
DNS.1 = istiod.{{ .SystemNamespace }}
DNS.2 = istiod.{{ .SystemNamespace }}.svc
DNS.3 = istio-pilot.{{ .SystemNamespace }}
DNS.4 = istio-pilot.{{ .SystemNamespace }}.svc
[ req_dn ]
O = Istio
CN = Intermediate CA
`
)

// NewIstioConfig creates an extensions configuration for Istio, using the given system namespace in
// the DNS SANs.
func NewIstioConfig(systemNamespace string) (string, error) {

		"tag=" + s.Image.Tag,
		"values.global.imagePullPolicy=" + s.Image.PullPolicy,
		"values.gateways.istio-ingressgateway.autoscaleEnabled=false",
	}

	if i.cfg.SystemNamespace != "istio-system" {
		setArgs = append(setArgs, "values.global.istioNamespace="+i.cfg.SystemNamespace)
	}

	// Include all user-specified values.
	for k, v := range i.cfg.Values {
		setArgs = append(setArgs, fmt.Sprintf("values.%s=%s", k, v))
	}

apiVersion: networking.istio.io/v1beta1
kind: DestinationRule
metadata:
  name: test-egress
  namespace: {{ .SystemNamespace.Name }}
spec:
  host: "{{ .EgressGatewayServiceName | default "istio-egressgateway" }}.{{ .EgressGatewayServiceNamespace | default .SystemNamespace.Name }}.svc.cluster.local"
  trafficPolicy:
    portLevelSettings:
      - port:
          number: 443
        tls:

`,
			children: childs,
			templateVars: func(_ echo.Callers, dests echo.Instances) map[string]any {
				systemNamespace := "istio-system"
				if t.Istio.Settings().SystemNamespace != "" {
					systemNamespace = t.Istio.Settings().SystemNamespace
				}
				return map[string]any{
					"SystemNamespace":   systemNamespace,
					"GatewayIstioLabel": t.Istio.Settings().IngressGatewayIstioLabel,
				}
			},
		})
	}

	// Namespace is the template parameter used for injecting the target namespace.Instance of the applied config.
	Namespace WellKnown = "Namespace"

	// SystemNamespace is the template parameter used for injecting the namespace.Instance of the Istio system.
	SystemNamespace WellKnown = "SystemNamespace"
)

func (p WellKnown) String() string {
	return string(p)
}

type WellKnownList []WellKnown

		header:      make(map[string]string),
		body:        new(bytes.Buffer),
		wroteHeader: false,
	}
}

func NewDebugGen(s *DiscoveryServer, systemNamespace string, debugMux *http.ServeMux) *DebugGen {
	return &DebugGen{
		Server:          s,
		SystemNamespace: systemNamespace,
		DebugMux:        debugMux,
	}
}

// Generate XDS debug responses according to the incoming debug request

						"multiple control planes. Error: %v", i.cfg.SystemNamespace, c.Name(), err)
				}
			} else {
				scopes.Framework.Errorf("failed creating namespace %s on cluster %s. This can happen when deploying "+
					"multiple control planes. Error: %v", i.cfg.SystemNamespace, c.Name(), err)
			}
		}

		// Create the secret for the cacerts.
		if _, err := c.Kube().CoreV1().Secrets(i.cfg.SystemNamespace).Create(context.TODO(), secret,

					param.Namespace.String():       to.Config().Namespace,
					param.SystemNamespace.String(): systemNS,
				}))
			}
		}
	}

	for _, to := range toAll {
		for _, s := range out.needTo {
			out.addYAML(withParams(s, param.Params{
				param.To.String():              to,
				param.Namespace.String():       to.Config().Namespace,
				param.SystemNamespace.String(): systemNS,
			}))
		}
	}

	return out
}

				log.Infof("joining leader-election for %s in %s on cluster %s",
					leaderelection.NamespaceController, options.SystemNamespace, options.ClusterID)
				election := leaderelection.
					NewLeaderElectionMulticluster(options.SystemNamespace, m.serverID, leaderelection.NamespaceController, m.revision, !configCluster, client).
					AddRunFunction(func(leaderStop <-chan struct{}) {

		MeshWatcher:           opts.MeshWatcher,
		ClusterID:             opts.ClusterID,
		MeshServiceController: meshServiceController,
		ConfigCluster:         opts.ConfigCluster,
		SystemNamespace:       opts.SystemNamespace,
	}
	c := NewController(opts.Client, options)
	meshServiceController.AddRegistry(c)

	if opts.ServiceHandler != nil {
		c.AppendServiceHandler(opts.ServiceHandler)
	}