func() (string, error) { return "instanceName", nil },
			func() (string, error) { return "instance", nil },
			func() (string, error) { return "instanceTemplate", nil },
			func() (string, error) { return "createdBy", nil },
			map[string]string{},
			map[string]string{
				GCPProject: "pid", GCPProjectNumber: "npid", GCPLocation: "location", GCPCluster: "cluster", GCEInstance: "instanceName",

	var allErrs field.ErrorList
	instanceNames := sets.New[string]()
	for i, instance := range instances {
		idxPath := fldPath.Index(i)
		instanceName := instance.Name
		allErrs = append(allErrs, validateInstanceName(instanceName, idxPath.Child("name"))...)
		if instanceNames.Has(instanceName) {
			allErrs = append(allErrs, field.Duplicate(idxPath.Child("name"), instanceName))
		} else {
			instanceNames.Insert(instanceName)

		// of the envoy filters has the proxy version set
		instanceName := ""
		if patch.Patch.GetValue() != nil {
			if patch.Patch.Value.GetFields() != nil {
				tmpValue := patch.Patch.Value.GetFields()
				tmpName := tmpValue["name"]
				if tmpName != nil {
					instanceName = tmpValue["name"].String()
				} else if patch.GetMatch() != nil {
					if patch.Match.GetListener() != nil {

										TlsMinimumProtocolVersion: tls.TlsParameters_TLSv1_1,
									},
									TlsCertificateCertificateProviderInstance: &tls.CommonTlsContext_CertificateProviderInstance{
										InstanceName:    "instance",
										CertificateName: "certificate",
									},
								},
							}),
						},
					},
				},
			},
		},
		{
			Name: "outbound|443||cluster2",

//     kubelet will use Hostname as the Node.Name when it creates the Node.
//
// * The cloudproviders have the own names: GCE has InstanceName, AWS has InstanceId.
//
//	For GCE, InstanceName is the Name of an Instance object in the GCE API.  On GCE, Instance.Name becomes the
//	Hostname, and thus it makes sense also to use it as the Node.Name.  But that is GCE specific, and it is up

			InstanceName:    "default",
			CertificateName: "default",
		},
		ValidationContextType: &tls.CommonTlsContext_CombinedValidationContext{
			CombinedValidationContext: &tls.CommonTlsContext_CombinedCertificateValidationContext{
				ValidationContextCertificateProviderInstance: &tls.CommonTlsContext_CertificateProviderInstance{
					InstanceName:    "default",
					CertificateName: "ROOTCA",
				},

// are consumed by Envoy itself, such as the telemetry filters.
type BootstrapNodeMetadata struct {
	NodeMetadata

	// InstanceName is the short name for the workload instance (ex: pod name)
	// replaces POD_NAME
	InstanceName string `json:"NAME,omitempty"`

	// Owner specifies the workload owner (opaque string). Typically, this is the owning controller of

	instanceName := "setup-instance"
	instance := &unstructured.Unstructured{
		Object: map[string]interface{}{
			"apiVersion": crd.Spec.Group + "/" + versions[0],
			"kind":       crd.Spec.Names.Kind,
			"metadata": map[string]interface{}{
				"namespace": ns,
				"name":      instanceName,
			},
			"alpha":   "foo_123",
			"beta":    10,

	shouldFillMetadata = func() bool {
		return metadata.OnGCE() && isMetadataEndpointAccessible()
	}
	projectIDFn        = metadata.ProjectID
	numericProjectIDFn = metadata.NumericProjectID
	instanceNameFn     = metadata.InstanceName
	instanceIDFn       = metadata.InstanceID

	clusterNameFn = func() (string, error) {
		cn, err := metadata.InstanceAttributeValue("cluster-name")
		if err != nil {
			return "", err
		}
		return cn, nil
	}

		switch name {
		case "ISTIO_METAJSON_LABELS":
			m := jsonStringToMap(val)
			if len(m) > 0 {
				meta.Labels = m
				meta.StaticLabels = m
			}
		case "POD_NAME":
			meta.InstanceName = val
		case "POD_NAMESPACE":
			meta.Namespace = val
		case "SERVICE_ACCOUNT":
			meta.ServiceAccount = val
		}
	}
	if plat != nil && len(plat.Metadata()) > 0 {