project  string
}

func (c *meshAuthCredentials) GetRequestMetadata(ctx context.Context, uri ...string) (map[string]string, error) {
	ret := map[string]string{
		"x-goog-user-project": c.project,
	}
	if err := updateAuthHdrs(ctx, uri, "k8s", c.k8sCreds, ret, "x-mesh-authorization"); err != nil {
		return nil, err
	}
	if err := updateAuthHdrs(ctx, uri, "gcp", c.gcpCreds, ret, "authorization"); err != nil {
		return nil, err
	}

        - "-c"
        - |-
          NODE_ID="sidecar~${INSTANCE_IP}~${POD_NAME}.${POD_NAMESPACE}~cluster.local"
          SERVER_URI="dns:///istiod.${ISTIO_NAMESPACE}.svc:15010"
          echo '
          {
            "xds_servers": [
              {
                "server_uri": "'${SERVER_URI}'",
                "channel_creds": [{"type": "insecure"}],
                "server_features" : ["xds_v3"]
              }
            ],

						Hosts:    []string{"productpage"},
						Gateways: []string{"fake-gw"},
						Http: []*v1alpha32.HTTPRoute{
							{
								Match: []*v1alpha32.HTTPMatchRequest{
									{
										Uri: &v1alpha32.StringMatch{
											MatchType: &v1alpha32.StringMatch_Prefix{
												Prefix: "/prefix",
											},
										},
									},
								},
								Route: []*v1alpha32.HTTPRouteDestination{

                          type: string
                        uri:
                          description: rewrite the path (or the prefix) portion of
                            the URI with this value.
                          type: string
                        uriRegexRewrite:
                          description: rewrite the path portion of the URI with the
                            specified regex.

                                  "format_string": {
                                    "text_format_source": {
                                      "inline_string": "%DOWNSTREAM_PEER_URI_SAN%"
                                    }
                                  },
                                  "shared_with_upstream": "ONCE",
                                  "factory_key": "envoy.string"

                          type: string
                        uri:
                          description: rewrite the path (or the prefix) portion of
                            the URI with this value.
                          type: string
                        uriRegexRewrite:
                          description: rewrite the path portion of the URI with the
                            specified regex.

message IngressRule {
  // host is the fully qualified domain name of a network host, as defined by RFC 3986.
  // Note the following deviations from the "host" part of the
  // URI as defined in RFC 3986:
  // 1. IPs are not allowed. Currently an IngressRuleValue can only apply to
  //    the IP in the Spec of the parent Ingress.
  // 2. The `:` delimiter is not respected because ports are not allowed.

            "forward_client_cert_details": "APPEND_FORWARD",
            "set_current_client_cert_details": {
             "subject": true,
             "dns": true,
             "uri": true
            },
            "upgrade_configs": [
             {
              "upgrade_type": "websocket"
             }
            ],
            "stream_idle_timeout": "0s",

object rewrite: description: Rewrite HTTP URIs and Authority headers. properties: authority: description: rewrite the Authority/Host header with this value. type: string uri: description: rewrite the path (or the prefix) portion of the URI with this value. type: string uriRegexRewrite: description: rewrite the path portion of the URI with the specified regex. properties: match: description: RE2 style regex-based match (https://github.com/google/re2/wiki/Syntax). type: string rewrite: description: The...

message IngressRule {
  // host is the fully qualified domain name of a network host, as defined by RFC 3986.
  // Note the following deviations from the "host" part of the
  // URI as defined in RFC 3986:
  // 1. IPs are not allowed. Currently an IngressRuleValue can only apply to
  //    the IP in the Spec of the parent Ingress.
  // 2. The `:` delimiter is not respected because ports are not allowed.