return ""
	}
	t := make([]byte, 0, 32)
	i := 0
	if isWordSeparator(s[0]) {
		// Need a capital letter; drop the '_'.
		t = append(t, 'X')
		i++
	}
	// Invariant: if the next letter is lower case, it must be converted
	// to upper case.
	// That is, we process a word at a time, where words are marked by _, - or
	// upper case letter. Digits are treated as words.
	for ; i < len(s); i++ {
		c := s[i]

  // workloads that were selected by their labels.
  WORKLOAD_SELECTOR = 2;
}

enum Action {
  // Allow the request if it matches with the rules.
  ALLOW = 0;
  // Deny the request if it matches with the rules.
  DENY = 1;

// limitations under the License.

package tmpl

import (
	"fmt"

	"istio.io/istio/pkg/test"
	"istio.io/istio/pkg/test/util/file"
)

// Evaluate parses the template and then executes it with the given parameters.
func Evaluate(tpl string, data any) (string, error) {
	t, err := Parse(tpl)
	if err != nil {
		return "", err
	}

	return Execute(t, data)
}

# The following virtual service should cause the error IST0149 because it uses JWT claim based routing but there is
# no request authentication applied on the gateway.
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: foo
spec:
  hosts:
    - "foo.com"
  gateways:
    - foo-gateway
  http:
    - match:
        - uri:
            prefix: /
          headers:
            "@request.auth.claims.foo":

	// metadata server code against a fake metadata server. We do not control the client, and cannot
	// configure it to exit early, retry faster, etc - its all fixed. As a result, we don't have a good
	// way to shut it down if it is still retrying in the background.

		grpc.MaxConcurrentStreams(uint32(maxStreams)),
		grpc.MaxRecvMsgSize(maxRecvMsgSize),
		// Ensure we allow clients sufficient ability to send keep alives. If this is higher than client
		// keep alive setting, it will prematurely get a GOAWAY sent.
		grpc.KeepaliveEnforcementPolicy(keepalive.EnforcementPolicy{
			MinTime: options.Time / 2,
		}),
		grpc.KeepaliveParams(keepalive.ServerParameters{
			Time:                  options.Time,

ambient mode no longer use the original service account or namespace attachment semantics. If you were using a namespace-scope waypoint previously migration should be fairly straight forward. Annotate your namespace with the appropriate waypoint and it should function in a similar way.

      If you were using service account attachment there will be more to understand. Under the old waypoint logic all types of traffic, both addressed to a service as well as addressed to a workload, were treated...

		},
		{
			// client side traffic could not be identified by the outbound listener, sent over one-way
			// TLS (HTTPS for example) by the downstream application.
			// or it could be that the client has no sidecar, and it is directly making a HTTPS connection to
			// this sidecar. In this case, this filter chain is receiving plaintext one-way TLS traffic. The TLS

// Schemas contains metadata about configuration resources.
type Schemas struct {
	byCollection map[config.GroupVersionKind]resource.Schema
	byAddOrder   []resource.Schema
}

// SchemasFor is a shortcut for creating Schemas. It uses MustAdd for each element.
func SchemasFor(schemas ...resource.Schema) Schemas {
	b := NewSchemasBuilder()
	for _, s := range schemas {
		b.MustAdd(s)
	}
	return b.Build()
}

		// Log sync will send logs to install-cni container via UDS.
		// We don't need a timeout here because underlying the log pkg already handles it.
		// this may fail, but it should be safe to ignore according
		// to https://github.com/uber-go/zap/issues/328
		_ = log.Sync()
	}()

	// TODO: implement plugin version
	funcs := skel.CNIFuncs{
		Add:   plugin.CmdAdd,
		Del:   plugin.CmdDelete,
		Check: plugin.CmdCheck,
	}