nodeSelectorTerms: - matchExpressions: {{- if .global.arch }} - key: kubernetes.io/arch operator: In values: {{- range $key, $val := .global.arch }} {{- if gt ($val | int) 0 }} - {{ $key | quote }} {{- end }} {{- end }} {{- end }} {{- range $key, $val := $nodeSelector }} - key: {{ $key }} operator: In values: - {{ $val | quote }} {{- end }} {{- end }} {{- end }} {{- define "nodeAffinityPreferre" }} {{- range $key, $val := .global.arch }} {{- if gt ($val | int) 0 }} - weight: {{ $val | int }} preference: matchExpressions:...

			for _, rm := range ip.GetRangeMatchers() {
				for _, r := range rm.Ranges {
					cidr := r.AddressPrefix
					pl := r.PrefixLen.GetValue()
					if pl != 32 && pl != 128 {
						cidr += fmt.Sprintf("/%d", pl)
					}
					m[cidr] = rm.OnMatch
				}
			}
		default:
			panic("unhandled")
		}
	}
	outputs := []string{}
	for k, v := range m {
		switch v := v.GetOnMatch().(type) {

			}
			labels := make([]string, 0)
			for _, me := range selector.MatchExpressions {
				if me.Operator != metav1.LabelSelectorOpIn {
					continue
				}
				for _, v := range me.Values {
					labels = append(labels, fmt.Sprintf("%s=%s", me.Key, v))
				}
			}
			return labels
		}

		var isDeactivated bool
		for _, wh := range whs {

func forEachInpodMarkIPRule(cfg *Config, f func(*netlink.Rule) error) error {
	var rules []*netlink.Rule
	families := []int{unix.AF_INET}
	if cfg.EnableIPv6 {
		families = append(families, unix.AF_INET6)
	}
	for _, family := range families {
		// Equiv:
		// ip rule add fwmark 0x111/0xfff pref 32764 lookup 100
		//
		// Adds in-pod rules for marking packets with the istio-specific TPROXY mark.
		// A very similar mechanism is used for sidecar TPROXY.

      value: |
             {{ protoToJSON .ProxyConfig }}
    - name: ISTIO_META_POD_PORTS
      value: |-
        [
        {{- $first := true }}
        {{- range $index1, $c := .Spec.Containers }}
          {{- range $index2, $p := $c.Ports }}
            {{- if (structToJSON $p) }}
            {{if not $first}},{{end}}{{ structToJSON $p }}
            {{- $first = false }}
            {{- end }}

		},
		"ipv6": {
			"internalIP": "fd00:10:96::1",
			"ingressIP":  "fd00:10:96::2",
		},
	}
	for _, dir := range files {
		if !dir.IsDir() {
			continue
		}
		testdir := path.Join("testdata/vmconfig", dir.Name())
		t.Cleanup(func() {
			for k := range generated {
				os.Remove(path.Join(testdir, k))
			}
		})
		t.Run(dir.Name(), func(t *testing.T) {

	for _, l := range listenerDump.DynamicListeners {
		// If a listener was reloaded, it would contain both the active and draining state
		// delete the draining state for proper comparison
		l.DrainingState = nil
		if l.ActiveState != nil {
			dal = append(dal, l)
		}
	}

	// Support v2 or v3 in config dump. See ads.go:RequestedTypes for more info.
	for i := range dal {

		return fmt.Errorf("config writer has not been primed")
	}

	w := new(tabwriter.Writer).Init(c.Stdout, 0, 8, 5, ' ', 0)

	clusterEndpoint := make([]EndpointCluster, 0)
	for _, cluster := range c.clusters.ClusterStatuses {
		for _, host := range cluster.HostStatuses {
			if filter.Verify(host, cluster.Name) {
				addr := retrieveEndpointAddress(host)
				port := retrieveEndpointPort(host)
				status := retrieveEndpointStatus(host)

		inputFile   string
		wantErr     bool
	}{
		{
			name:        "errors if unable to unmarshal bytes",
			inputFile:   "",
			wantConfigs: 0,
			wantErr:     true,
		},
	}
	for _, tt := range tests {
		t.Run(tt.name, func(t *testing.T) {
			cw := &ConfigWriter{}
			cd, _ := os.ReadFile(tt.inputFile)
			err := cw.Prime(cd)
			if cw.configDump == nil {
				if tt.wantConfigs != 0 {

          {{- if not $gateway.runAsRoot }}
          - name: ISTIO_META_UNPRIVILEGED_POD
            value: "true"
          {{- end }}
          {{- range $key, $val := $gateway.env }}
          - name: {{ $key }}
            value: "{{ $val }}"
          {{- end }}
          {{- range $key, $value := .Values.meshConfig.defaultConfig.proxyMetadata }}
          - name: {{ $key }}
            value: "{{ $value }}"
          {{- end }}