# prepare a distroless source context to copy files from
FROM gcr.io/distroless/static-debian11@sha256:9be3fcc6abeaf985b5ecce59451acbcbb15e7be39472320c538d0d55a0834edc as distroless_source

# prepare a base dev to modify file contents
FROM ubuntu:noble as ubuntu_source

# Modify contents of container
COPY --from=distroless_source /etc/ /home/etc
COPY --from=distroless_source /home/nonroot /home/nonroot
RUN echo istio-proxy:x:1337: >> /home/etc/group

       {
        "name": "backend",
        "domains": [
         "*"
        ],
        "routes": [
         {
          "match": {
           "prefix": "/stats/prometheus"
          },
          "route": {
           "cluster": "prometheus_stats"
          }
         }
        ]
       }
      ]
     },
     "last_updated": "2023-11-29T09:58:27.285Z"
    }
   ]
  }
 ]

       {
        "name": "backend",
        "domains": [
         "*"
        ],
        "routes": [
         {
          "match": {
           "prefix": "/stats/prometheus"
          },
          "route": {
           "cluster": "prometheus_stats"
          }
         }
        ]
       }
      ]
     },
     "last_updated": "2023-11-29T09:58:27.285Z"
    }
   ],
   "dynamic_route_configs": [

# shellcheck disable=SC1001
LATEST_DEB11_DISTROLESS_SHA256=$(crane digest gcr.io/distroless/static-debian11 | awk -F\: '{print $2}')
sed -i -E "s/sha256:[a-z0-9]+/sha256:${LATEST_DEB11_DISTROLESS_SHA256}/g" docker/Dockerfile.distroless

# shellcheck disable=SC1001

  // spec.audiences field should validate that a compatible audience identifier
  // is returned in the status.audiences field to ensure that the TokenReview
  // server is audience aware. If a TokenReview returns an empty
  // status.audience field where status.authenticated is "true", the token is
  // valid against the audience of the Kubernetes API server.
  // +optional
  repeated string audiences = 4;

  // If unset, should be treated as "True".
  // +optional
  optional string status = 6;

  // brief reason for the request state
  // +optional
  optional string reason = 2;

  // human readable message with details about the request state
  // +optional
  optional string message = 3;

  // timestamp for the last update to this condition
  // +optional

  // Result contains extra details into why an admission request was denied.
  // This field IS NOT consulted in any way if "Allowed" is "true".
  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.Status status = 3;

  // The patch body. Currently we only support "JSONPatch" which implements RFC 6902.
  // +optional
  optional bytes patch = 4;

  // The type of Patch. Currently we only allow "JSONPatch".

type PodFilteredInfo struct {
	Namespace string          `json:"namespace"`
	Name      string          `json:"name"`
	Address   string          `json:"address"`
	Status    corev1.PodPhase `json:"status"`
	Age       string          `json:"age"`
}

// IstioOperatorCRInfo represents a tiny subset of fields from
// IstioOperator CR. This structure is used for displaying data.
// Exposed for integration test

    # on this list. Setting this to the health check port will ensure that health
    # checks always work. https://github.com/istio/istio/issues/12503
    - port: 15021
      targetPort: 15021
      name: status-port
    - port: 80
      targetPort: 8080
      name: http2
    - port: 443
      targetPort: 8443
      name: https
    - port: 31400
      targetPort: 31400
      name: tcp

      volumeMounts:
        - mountPath: /var/lib/grpc/data/
          name: grpc-io-proxyless-bootstrap
      env:
        - name: INSTANCE_IP
          valueFrom:
            fieldRef:
              fieldPath: status.podIP
        - name: POD_NAME
          valueFrom:
            fieldRef:
              fieldPath: metadata.name
        - name: POD_NAMESPACE
          valueFrom:
            fieldRef: