optional k8s.io.apimachinery.pkg.apis.meta.v1.GroupVersionKind kind = 2;

  // Resource is the fully-qualified resource being requested (for example, v1.pods)
  optional k8s.io.apimachinery.pkg.apis.meta.v1.GroupVersionResource resource = 3;

  // SubResource is the subresource being requested, if any (for example, "status" or "scale")
  // +optional

			WantException:  true,
		},
		{ // case 11
			Args:           strings.Split("envoy --selector app=example --browser=false", " "),
			ExpectedRegexp: regexp.MustCompile(".*no pods found"),
			WantException:  true,
		},
		{ // case 12
			Args:           strings.Split("envoy --browser=false --selector app=example pod-123456-7890", " "),
			ExpectedRegexp: regexp.MustCompile(".*Error: name cannot be provided when a selector is specified"),

			domains:  []string{"example.com", "example.com:8080", "[fd00:10:96::7fc7]", "[fd00:10:96::7fc7]:8080"},
			expected: "example.com, [fd00:10:96::7fc7]",
		},
		{
			desc:     "test with more domains",
			domains:  []string{"example.com", "example.com:8080", "www.example.com", "www.example.com:8080", "[fd00:10:96::7fc7]", "[fd00:10:96::7fc7]:8080"},
			expected: "example.com, www.example.com + 1 more...",
		},
	}

to allow arbitrary customizations.

If the change truly is generally purpose, it is generally preferred to have broader APIs. For example, instead of providing
direct access to each of the complex fields in [affinity](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/), just providing

NAME          VHOST NAME                 DOMAINS                 MATCH                  VIRTUAL SERVICE
http.8080     httpbin.example.com:80     httpbin.example.com     /get*                  httpbin.default
              backend                    *                       /stats/prometheus*     

  global:
    # Used to locate istiod.
    istioNamespace: "istio-system"

  base:
    # Validation webhook configuration url
    # For example: https://$remotePilotAddress:15017/validate
    validationURL: ""

  istiodRemote:
    # Sidecar injector mutating webhook configuration url
    # For example: https://$remotePilotAddress:15017/inject
    injectionURL: ""

```yaml
apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
  name: strict-and-permissive-mtls
spec:
  selector:
    matchLabels:
      app: a
  mtls:

- Better security: separate Istio components reside in different namespaces, allowing different teams or
roles to manage different parts of Istio. For example, a security team would maintain the
root CA and policy, a telemetry team may only have access to Prometheus,
and a different team may maintain the control plane components (which are highly security sensitive).

# limitations under the License.

# retry.sh retries a command until it succeeds. It accepts a regex pattern to match failures on to
# determine if a retry should be attempted.
# Example: retry.sh "connection timed out" ./my-flaky-script.sh some args
# This will run "my-flaky-script.sh", retrying any failed runs that output "connection timed out" up
# to 5 times.

function fail {
  echo "${1}" >&2

Retrieves the debug information from Istiod or Pods in the mesh using the service account from the pod if --cert-dir is empty.
By default it will use the default serviceAccount from (istio-system) namespace if the pod is not specified.
`,
		Example: `  # Retrieve sync status for all Envoys in a mesh
  istioctl x internal-debug syncz

  # Retrieve sync diff for a single Envoy and Istiod
  istioctl x internal-debug syncz istio-egressgateway-59585c5b9c-ndc59.istio-system