apiVersion: v1
clusters:
- cluster:
    insecure-skip-tls-verify: true
    server: https://10.96.0.1:443
  name: local
contexts:
- context:
    cluster: local
    user: istio-cni
  name: istio-cni-context
current-context: istio-cni-context
kind: Config
preferences: {}
users:
- name: istio-cni
  user:

			expectedFailure: true,
		},
		{
			name:            "k8s service port not set",
			expectedFailure: true,
			k8sServiceHost:  k8sServiceHost,
		},
		{
			name:           "skip TLS verify",
			k8sServiceHost: k8sServiceHost,
			k8sServicePort: k8sServicePort,
			skipTLSVerify:  true,
		},
		{
			name:           "TLS verify",
			k8sServiceHost: k8sServiceHost,

- if deployed by manifest, add env `FELIX_WORKLOADSOURCESPOOFING` with value `Any` in `spec.template.spec.containers.env` for daemonset `calico-node`. (This will allow PODs with specified annotation to skip the rpf check. )

### GKE notes

On GKE, 'kube-system' is required.

If using `helm template`, `--set cni.cniBinDir=/home/kubernetes/bin` is required - with `helm install`

		// nolint: gosec
		// Only runs over istioctl experimental
		// TODO: https://github.com/istio/istio/issues/41937
		grpc.WithTransportCredentials(credentials.NewTLS(
			&tls.Config{
				// Always skip verifying, because without it we always get "certificate signed by unknown authority".
				// We don't set the XDSSAN for the same reason.
				InsecureSkipVerify: true,
			})),
		grpc.WithPerRPCCredentials(k8sCreds),

    {{ if .Values.global.logAsJson -}}
    - "--log_as_json"
    {{ end -}}
    {{ if or .Values.pilot.cni.enabled .Values.istio_cni.enabled -}}
    - "--run-validation"
    - "--skip-rule-apply"
    {{ end -}}
    {{with .Values.global.imagePullPolicy }}imagePullPolicy: "{{.}}"{{end}}
  {{- if .ProxyConfig.ProxyMetadata }}
    env:
    {{- range $key, $value := .ProxyConfig.ProxyMetadata }}

    {{ if .Values.global.logAsJson -}}
    - "--log_as_json"
    {{ end -}}
    {{ if or .Values.pilot.cni.enabled .Values.istio_cni.enabled -}}
    - "--run-validation"
    - "--skip-rule-apply"
    {{ end -}}
    {{with .Values.global.imagePullPolicy }}imagePullPolicy: "{{.}}"{{end}}
  {{- if .ProxyConfig.ProxyMetadata }}
    env:
    {{- range $key, $value := .ProxyConfig.ProxyMetadata }}

var (
	typeLabel  = monitoring.CreateLabel("type")
	deleteType = "delete"
	repairType = "repair"
	labelType  = "label"

	resultLabel   = monitoring.CreateLabel("result")
	resultSuccess = "success"
	resultSkip    = "skip"
	resultFail    = "fail"

	podsRepaired = monitoring.NewSum(
		"istio_cni_repair_pods_repaired_total",
		"Total number of pods repaired by repair controller",
	)

See %s for more information about causes and resolutions.`, url.ConfigAnalysis)
					return errors.New(e)
				}
			}
			return nil
		},
	}
	cmd.PersistentFlags().BoolVar(&skipControlPlane, "skip-controlplane", false, "skip checking the control plane")
	cmd.PersistentFlags().Var(&outputThreshold, "output-threshold",
		fmt.Sprintf("The severity level of precheck at which to display messages. Valid values: %v", diag.GetAllLevelStrings()))

				if err != nil {
					return nil, fmt.Errorf("could not unmarshal Node: %w", err)
				}
				meta, err := model.ParseMetadata(node.Metadata)
				if err != nil || meta.ProxyConfig == nil {
					// Skip non-sidecars (e.g. istioctl queries)
					continue
				}
				pi = append(pi, istioVersion.ProxyInfo{
					ID:           node.Id,
					IstioVersion: getIstioVersionFromXdsMetadata(node.Metadata),
				})

			expectedPostCleanFile:  testDataDir + "/expected/minikube_cni.conflist.clean",
			cniConfDirOrderedFiles: []string{"minikube_cni.conf", "calico.conflist"},
		},
		{
			name:                   "Skip non-json file for first valid .conf file",
			chainedCNIPlugin:       true,
			resultFileName:         "01-minikube_cni.conflist",
			expectedOutputFile:     testDataDir + "/expected/minikube_cni.conflist.expected",