// assumed to be status codes.
		out.RetryOn, out.RetriableStatusCodes = parseRetryOn(in.RetryOn)
		// If user has just specified HTTP status codes in retryOn but have not specified "retriable-status-codes", let us add it.
		if len(out.RetriableStatusCodes) > 0 && !strings.Contains(out.RetryOn, "retriable-status-codes") {
			out.RetryOn += ",retriable-status-codes"
		}
	}

	if in.PerTryTimeout != nil {

		exp.String(), gracePeriod.String(), rotate)
	return rotate
}

// GetPlatformCredential fetches the GCE VM identity jwt token from its metadata server,
// and write it to jwtPath. The local copy of the token in jwtPath is used by both
// Envoy STS client and istio agent to fetch certificate and access token.
// Note: this function only works in a GCE VM environment.

	knownIstioListeners sets.String

	exitOnZeroActiveConnections bool

	skipDrain *atomic.Bool
}

type exitStatus struct {
	err error
}

// Run starts the envoy and waits until it terminates.
// There are a few exit paths:
//  1. Envoy exits. In this case, we simply log and exit.

		ikey := makeInstanceKey(instance)
		hostPort := hostPort{ikey, instance.ServicePort.Port}
		// For DNSRoundRobinLB resolution type, check if service instances already exist and do not add
		// if it already exist. This can happen if two Service Entries are created with same host name,
		// resolution as DNS_ROUND_ROBIN and with same/different endpoints.
		if instance.Service.Resolution == model.DNSRoundRobinLB &&

		trusted bool
	}{
		{
			name:    "localhost client with port",
			cidr:    "",
			peer:    "127.0.0.1:9901",
			trusted: true,
		},
		{
			// Should never happen, added test case for testing it.
			name:    "localhost client without port",
			cidr:    "",
			peer:    "127.0.0.1",
			trusted: false,
		},
		{
			name:    "external client without trusted cidr",
			cidr:    "",
			peer:    "172.0.0.1",

		Ports:     []echo.Port{},
		Subsets: []echo.SubsetConfig{{
			Version: "v1",
			// Set up custom annotations to mount the certs. We will re-use the configmap created by "server"
			// so that we don't need to manage it ourselves.
			// The paths here match the destination rule above
			Annotations: map[string]string{
				annotation.SidecarUserVolume.Name:      `{"custom-certs":{"configMap":{"name":"server-certs"}}}`,

// from "a" so that it cannot reach "external" directly, and we use a ServiceEntry to define our "external" website, which
// is static and points to the service "external" ip.

// Thus when "a" tries to mirror to the external service, it is actually connecting to "external" (which is not part of the

            # But we don't need _everything_ in `privileged`, so drop+readd capabilities based on feature.
            # privileged is redundant with CAP_SYS_ADMIN
            # since it's redundant, hardcode it to `true`, then manually drop ALL + readd granular
            # capabilities we actually require
            capabilities:
              drop:
              - ALL
              add:

	if gen == nil {
		return nil
	}

	t0 := time.Now()

	// If delta is set, client is requesting new resources or removing old ones. We should just generate the
	// new resources it needs, rather than the entire set of known resources.
	// Note: we do not need to account for unsubscribed resources as these are handled by parent removal;

// the schema. It also returns the list of unrecognized kinds as the second
// response.
//
// NOTE: This function only decodes a subset of the complete k8s
// ObjectMeta as identified by the fields in model.Meta. This
// would typically only be a problem if a user dumps an configuration
// object with kubectl and then re-ingests it.