should be locked down and restricted.  The new installer allows multiple instances of
policy/control/telemetry - so testing/staging of new settings and versions can be performed
by a different role than the prod version.

The intended users of this repo are users running Istio in production who want to select, tune
and understand each binary that gets deployed, and select which combination to use.

        .sslSocketFactory(sslContext.socketFactory, trustManager)
        .build()

    // An example test URL that returns client certificate details.
    val request =
      Request.Builder()
        .url("https://prod.idrix.eu/secure/")
        .build()

    client.newCall(request).execute().use { response ->
      if (!response.isSuccessful) throw IOException("Unexpected code $response")

      println(response.body.string())
    }

|PROV_CERT|certificates to be used for mTLS communication with control plane only; NOT for workload mTLS|
|OUTPUT_CERT|write all fetched certificates to some directory. Used to support applications that need certificates (Prometheus) as well as rotating mTLS control plane authentication.|
|FILE_MOUNTED_CERTS|completely disable CA path, exclusively use certs mounted into the pod with set certificate file locations|

wget https://dl.min.io/server/minio/release/linux-amd64/minio -O /mnt/export/${USER}/bin/minio
chmod +x /mnt/export/${USER}/bin/minio
```

Bind your `proc` mount to the target chroot directory

```
sudo mount --bind /proc /mnt/export/${USER}/proc
```

## 3. Run Standalone MinIO in Chroot

### GNU/Linux

```sh

# Files that should be ignored by tools which do not want to consider generated
# code.
#
# https://github.com/kubernetes/test-infra/blob/master/prow/plugins/size/size.go
#
# This file is a series of lines, each of the form:
#     <type> <name>
#
# Type can be:
#    path - an exact path to a single file
#    file-name - an exact leaf filename, regardless of path
#    path-prefix - a prefix match on the file path

security/cmd/node_agent/na/cert_file
security/cmd/node_agent/na/pkey
# istioctl bash completion file
tools/istioctl.bash
vendor
# Contains the built artifacts
out/
etc/
var/
# Go compiled tests
*.test
# Profiles
*.prof
# MacOS extended attributes
._*
# MacOS Desktop Services Store

      .apply {
        setProperty(
          "${Constants.PLUGIN}.$REPO_NAME",
          LocalIndexedRepo::class.java.getName() +
            "; ${LocalIndexedRepo.PROP_NAME} = '$REPO_NAME'" +
            "; ${LocalIndexedRepo.PROP_LOCAL_DIR} = '$repoDir'",
        )
        refresh()
        prepareWorkspace()
      }
  }

  private fun Workspace.prepareWorkspace() {

/www/master/shared/config/development.json

# Karma output
/www/test_out

# precommit temporary directories created by ./hack/verify-generated-docs.sh and ./hack/lib/util.sh
/_tmp/
/doc_tmp/

# Test artifacts produced by Prow/kubetest2 jobs
/_artifacts/
/_rundir/

# Go dependencies installed on Jenkins
/_gopath/

# Config directories created by gcloud and gsutil on Jenkins
/.config/gcloud*/
/.gsutil/

# CoreOS stuff

    internal const val NAME = "okcurl"
    internal const val DEFAULT_TIMEOUT = -1

    private fun versionString(): String? {
      val prop = Properties()
      Main::class.java.getResourceAsStream("/okcurl-version.properties")?.use {
        prop.load(it)
      }
      return prop.getProperty("version", "dev")
    }

    private fun createInsecureTrustManager(): X509TrustManager =
      object : X509TrustManager {

        ; fess = map:{
            ; path = ..
            ; freeGenList = list:{ env ; config ; label ; message ; mail ; template ; jsp ; doc }
            ; configPluginInterface = org.codelibs.fess.mylasta.direction.FessProp
            ; propertiesHtmlList = list:{ env ; config ; label ; message }
        }
    }

    ; isUseDefaultConfigAtGeneration = true
    # you can override (several) default settings like this: