package core

import (
	"fmt"
	"reflect"
	"testing"

	cluster "github.com/envoyproxy/go-control-plane/envoy/config/cluster/v3"
	core "github.com/envoyproxy/go-control-plane/envoy/config/core/v3"
	proxyprotocol "github.com/envoyproxy/go-control-plane/envoy/extensions/transport_sockets/proxy_protocol/v3"
	tls "github.com/envoyproxy/go-control-plane/envoy/extensions/transport_sockets/tls/v3"

	networking "istio.io/api/networking/v1alpha3"

apiVersion: release-notes/v2
kind: feature
area: installation
issue:
  - 51506
releaseNotes:
- |

// See the License for the specific language governing permissions and
// limitations under the License.

package authz

import (
	listener "github.com/envoyproxy/go-control-plane/envoy/config/listener/v3"
	hcm "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/network/http_connection_manager/v3"

	"istio.io/istio/pilot/pkg/model"
	"istio.io/istio/pilot/pkg/networking"
	"istio.io/istio/pilot/pkg/security/authz/builder"

func (c Clusters) MeshClusters(excluded ...Cluster) Clusters {
	return c.filterClusters(func(cc Cluster) bool {
		return !cc.IsExternalControlPlane()
	}, exclude(excluded...))
}

// IsExternalControlPlane indicates whether the clusters are set up in an enternal
// control plane configuration. An external control plane is a primary cluster that

		"A list of checks whose errors will be shown as warnings. Example: 'IsPrivilegedUser,Swap'. Value 'all' ignores errors from all checks.",
	)
}

// AddControlPlanExtraArgsFlags adds the ExtraArgs flags for control plane components
func AddControlPlanExtraArgsFlags(fs *pflag.FlagSet, apiServerExtraArgs, controllerManagerExtraArgs, schedulerExtraArgs *map[string]string) {
	// TODO: https://github.com/kubernetes/kubeadm/issues/1601

	// First, check if we're root separately from the other preflight checks and fail fast
	if err := preflight.RunRootCheckOnly(data.IgnorePreflightErrors()); err != nil {
		return err
	}

	// If this is a control-plane node, pull the basic images
	if data.IsControlPlaneNode() {
		// Update the InitConfiguration used for RunPullImagesCheck with ImagePullPolicy and ImagePullSerial
		// that come from UpgradeNodeConfiguration.

  metrics endpoint from outside of the pod, to allow only localhost access. User can use set this with command
  `--set values.pilot.env.METRICS_LOCALHOST_ACCESS_ONLY=true` for Control plane and  

# This version is never actually shipped. istio/release-builder will replace it at build-time
# with the appropriate version
version: 1.0.0
appVersion: 1.0.0
description: Helm chart for a remote cluster using an external istio control plane
keywords:
  - istio
  - external-istiod
sources:
  - https://github.com/istio/istio

apiVersion: v2
name: istiod
# This version is never actually shipped. istio/release-builder will replace it at build-time
# with the appropriate version
version: 1.0.0
appVersion: 1.0.0
description: Helm chart for istio control plane
keywords:
  - istio
  - istiod
  - istio-discovery
sources:
  - https://github.com/istio/istio

func PrintFilesIfDryRunning(needPrintManifest bool, manifestDir string, outputWriter io.Writer) error {
	var files []FileToPrint
	// Print static pod manifests if it is a control plane
	if needPrintManifest {
		fmt.Printf("[dryrun] Wrote certificates, kubeconfig files and control plane manifests to the %q directory\n", manifestDir)
		for _, component := range kubeadmconstants.ControlPlaneComponents {