)

type meshAuthCredentials struct {
	k8sCreds credentials.PerRPCCredentials
	gcpCreds credentials.PerRPCCredentials
	project  string
}

func (c *meshAuthCredentials) GetRequestMetadata(ctx context.Context, uri ...string) (map[string]string, error) {
	ret := map[string]string{
		"x-goog-user-project": c.project,
	}
	if err := updateAuthHdrs(ctx, uri, "k8s", c.k8sCreds, ret, "x-mesh-authorization"); err != nil {
		return nil, err
	}

eventually someone will want to customize every one of those fields.
If all fields are exposed in `values.yaml`, we end up with an massive API that is also likely worse than just using the Kubernetes API directly.

To avoid this, the project attempts to minimize additions to the `values.yaml` API where possible.

If the change is a dynamic runtime configuration, it probably belongs in the [MeshConfig API](https://github.com/istio/api/blob/master/mesh/v1alpha1/config.proto).

This project is covered by two different licenses: MIT and Apache.

#### MIT License ####

The following files were ported to Go from C files of libyaml, and thus
are still covered by their original MIT license, with the additional
copyright staring in 2011 when the project was ported over:

    apic.go emitterc.go parserc.go readerc.go scannerc.go
    writerc.go yamlh.go yamlprivateh.go

Copyright (c) 2006-2010 Kirill Simonov

# git history files
.history_rewritten_*
# Eclipse artifacts
.project
.pydevproject
#Vagrant
tools/vagrant/.vagrant/
# Intellij
*.iml
.idea/
.run/
# Visual Studio Code
.vscode/
# Bazel
/bazel-*
# vi swap files
.*.swp
# vi backups
*.bak
# common backups
*~
# python artifacts
*.pyc
# pilot
pilot/pkg/kube/config
pilot/pkg/proxy/envoy/envoy
# lint
lintconfig.gen.json
.istiorc
.istiorc.mk

```console
$ journalctl -t kubelet -n 1000 | less
```

#### GKE via Stackdriver Log Viewer

Each GKE cluster's will have many categories of logs collected by Stackdriver.  Logs can be monitored via
the project's [log viewer](https://cloud.google.com/logging/docs/view/overview) and/or the `gcloud logging read`
capability.

The following example grabs the last 10 `kubelet` logs containing the string "cmdAdd" in the log message.

        cpu: 10m
      #   memory: 128Mi
      # limits:
      #   cpu: 100m
      #   memory: 128Mi

    # Default hub for Istio images.
    # Releases are published to docker hub under 'istio' project.
    # Dev builds from prow are on gcr.io
    hub: gcr.io/istio-testing
    # Default tag for Istio images.
    tag: latest
    # Variant of the image to use.
    # Currently supported are: [debug, distroless]

# The forked go-yaml.v3 library under this project is covered by two
different licenses (MIT and Apache):

#### MIT License ####

The following files were ported to Go from C files of libyaml, and thus
are still covered by their original MIT license, with the additional
copyright staring in 2011 when the project was ported over:

    apic.go emitterc.go parserc.go readerc.go scannerc.go

Copyright 2021 The ANTLR Project

Redistribution and use in source and binary forms, with or without modification,
are permitted provided that the following conditions are met:

    1. Redistributions of source code must retain the above copyright notice,
    this list of conditions and the following disclaimer.

    2. Redistributions in binary form must reproduce the above copyright notice,

"seriesOverrides": [], "spaceLength": 10, "stack": false, "steppedLine": false, "targets": [ { "expr": "sum(pilot_xds_cds_reject{app=\"istiod\"}) or (absent(pilot_xds_cds_reject{app=\"istiod\"}) - 1)", "format": "time_series", "hide": false, "intervalFactor": 1, "legendFormat": "Rejected CDS Configs", "refId": "C" }, { "expr": "sum(pilot_xds_eds_reject{app=\"istiod\"}) or (absent(pilot_xds_eds_reject{app=\"istiod\"}) - 1)", "format": "time_series", "hide": false, "intervalFactor": 1, "legendFormat": "Rejected...

            path: labels
          - fieldRef:
              fieldPath: metadata.annotations
            path: annotations
        name: istio-podinfo
      - name: istio-token
        projected:
          sources:
          - serviceAccountToken:
              audience: istio-ca
              expirationSeconds: 43200
              path: istio-token
      - configMap: