// execute, when updating mp.curg.
	//
	// These are reachable only when exitsyscall finds no P available. Thus
	// we make C calls from significantly more Gs than there are available
	// Ps. Lots of runnable work combined with >20us spent in callGo makes
	// it possible for sysmon to retake Ps, forcing C calls to go down the
	// desired exitsyscall path.
	//
	// High GOMAXPROCS is used to increase opportunities for failure on

    {
      "etcd_endpoints": "http://10.110.0.136:6666",
      "ipam": {
        "type": "calico-ipam"
      },
      "kubernetes": {
        "kubeconfig": "/etc/cni/net.d/calico-kubeconfig"
      },
      "mtu": 1500,
      "plugin_log_level": "info",
      "policy": {
        "type": "k8s"
      },
      "type": "calico"
    },
    {
      "capabilities": {
        "portMappings": true
      },

The calico.yaml file is from [https://raw.githubusercontent.com/projectcalico/calico/v3.27.0/manifests/calico.yaml](https://raw.githubusercontent.com/projectcalico/calico/v3.27.0/manifests/calico.yaml)

Once downloaded, run the following sed command to replace the default docker.io images with istio-testing's copies of them:

```shell
sed -ie "s?docker.io?gcr.io/istio-testing?g" calico.yaml
```

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: calico
  labels:
    addonmanager.kubernetes.io/mode: Reconcile
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: calico
subjects:
- kind: ServiceAccount
  name: calico

apiVersion: v1
kind: ServiceAccount
metadata:
  name: calico
  namespace: kube-system
  labels:

// callTargetLSym returns the correct LSym to call 'callee' using its ABI.
func callTargetLSym(callee *ir.Name) *obj.LSym {
	if callee.Func == nil {
		// TODO(austin): This happens in case of interface method I.M from imported package.
		// It's ABIInternal, and would be better if callee.Func was never nil and we didn't
		// need this case.
		return callee.Linksym()
	}

	return callee.LinksymABI(callee.Func.ABI)
}

kind: ServiceAccount
apiVersion: v1
metadata:
  name: calico-cpva
  namespace: kube-system
  labels:

apiVersion: v1
kind: ServiceAccount
metadata:
  name: calico-kube-controllers
  namespace: kube-system
---
# Source: calico/templates/calico-node.yaml
apiVersion: v1
kind: ServiceAccount
metadata:
  name: calico-node
  namespace: kube-system
---
# Source: calico/templates/calico-node.yaml
apiVersion: v1
kind: ServiceAccount
metadata:
  name: calico-cni-plugin

    {
      "etcd_endpoints": "http://10.110.0.136:6666",
      "ipam": {
        "type": "calico-ipam"
      },
      "kubernetes": {
        "kubeconfig": "/etc/cni/net.d/calico-kubeconfig"
      },
      "mtu": 1500,
      "plugin_log_level": "info",
      "policy": {
        "type": "k8s"
      },
      "type": "calico"
    },
    {
      "capabilities": {
        "portMappings": true
      },

    verbs:
      - list
      - watch
  # The CNI plugin patches pods/status.
  - apiGroups: [""]
    resources:
      - pods/status
    verbs:
      - patch
  # Calico monitors various CRDs for config.
  # Note: Though we are not using ipam from calico, calico node still needs those permissions
  #       to boot.
  - apiGroups: ["crd.projectcalico.org"]
    resources:
      - globalfelixconfigs
      - felixconfigurations