"k8s.io/client-go/discovery"
	"k8s.io/client-go/rest"
	"k8s.io/client-go/restmapper"
	"k8s.io/client-go/tools/clientcmd"
	clientcmdapi "k8s.io/client-go/tools/clientcmd/api"
)

// TestConfigFlags contains clientConfig struct
// and interfaces that implements RESTClientGetter
type TestConfigFlags struct {
	clientConfig    clientcmd.ClientConfig
	discoveryClient discovery.CachedDiscoveryInterface

		Produces(mediaTypes...).
		Consumes(mediaTypes...).
		Writes(returnType))
	return ws
}

// WrapAggregatedDiscoveryToHandler wraps a handler with an option to
// emit the aggregated discovery by passing in the aggregated
// discovery type in content negotiation headers: eg: (Accept:
// application/json;v=v2;g=apidiscovery.k8s.io;as=APIGroupDiscoveryList)

// limitations under the License.

package xds

// xds uses ADSC to call XDS

import (
	"context"
	"crypto/tls"
	"fmt"
	"strings"

	discovery "github.com/envoyproxy/go-control-plane/envoy/service/discovery/v3"
	"google.golang.org/grpc"
	"google.golang.org/grpc/credentials"

	"istio.io/istio/istioctl/pkg/clioptions"
	"istio.io/istio/pilot/pkg/model"
	"istio.io/istio/pkg/adsc"

package version

import (
	"context"
	"encoding/json"
	"fmt"
	"os"

	core "github.com/envoyproxy/go-control-plane/envoy/config/core/v3"
	discovery "github.com/envoyproxy/go-control-plane/envoy/service/discovery/v3"
	statusv3 "github.com/envoyproxy/go-control-plane/envoy/service/status/v3"
	"github.com/spf13/cobra"
	"github.com/spf13/pflag"
	"google.golang.org/protobuf/types/known/structpb"

			args:          strings.Split("serviceaccount/sleep", " "),
			wantException: true,
		},
	}
	multixds.GetXdsResponse = func(_ *discovery.DiscoveryRequest, _ string, _ string, _ clioptions.CentralControlPlaneOptions, _ []grpc.DialOption,
	) (*discovery.DiscoveryResponse, error) {
		return &discovery.DiscoveryResponse{}, nil
	}
	t.Cleanup(func() {
		multixds.GetXdsResponse = xds.GetXdsResponse
	})

	for i, c := range cases {

	nsB := "nsB"

	// Create a namespace with discovery selector enabled
	createNamespace(t, client.Kube(), nsA, map[string]string{"discovery-selectors": "enabled"})
	// Create a namespace without discovery selector enabled
	createNamespace(t, client.Kube(), nsB, map[string]string{})
	expectConfigMap(t, nc.configmaps, CACertNamespaceConfigMap, nsA, expectedData)
	// config map should not be created for discovery selector disabled namespace

	any1  = &discovery.Resource{Resource: &anypb.Any{TypeUrl: "foo"}}
	any2  = &discovery.Resource{Resource: &anypb.Any{TypeUrl: "bar"}}
)

// TestXdsCacheToken is a regression test to ensure that we do not write
// nolint: gosec
// Test only code
func TestXdsCacheToken(t *testing.T) {
	c := model.NewXdsCache()
	n := atomic.NewInt32(0)
	mkv := func(n int32) *discovery.Resource {

## Authentication

The agent supports two forms of authentication with the CA/discovery servers: mTLS and JWT. Varying deployment
topologies mix and match these two.

For a standard Kubernetes deployment, both CA and discovery will use JWT authentication, with a token automatically

// See the License for the specific language governing permissions and
// limitations under the License.

package xds

import (
	discovery "github.com/envoyproxy/go-control-plane/envoy/service/discovery/v3"

	"istio.io/istio/pilot/pkg/model"
	"istio.io/istio/pilot/pkg/util/protoconv"
	v3 "istio.io/istio/pilot/pkg/xds/v3"
	"istio.io/istio/pkg/config/schema/kind"

	// Discovery().Serverversion() resource for a dynamic client(?).
	fakeclientDiscovery, ok := g.client.Discovery().(*fakediscovery.FakeDiscovery)
	if ok {
		clusterVersionInfo = fakeclientDiscovery.FakedServerVersion
	} else {
		clusterVersionInfo, err = g.client.Discovery().ServerVersion()
		if err != nil {