defaultClusterLocalHosts = append(defaultClusterLocalHosts, host.Name(s+"."+domainSuffix))
	}

	if discoveryHost, _, err := e.GetDiscoveryAddress(); err != nil {
		log.Errorf("failed to make discoveryAddress cluster-local: %v", err)
	} else {
		if !strings.HasSuffix(string(discoveryHost), domainSuffix) {
			discoveryHost += host.Name("." + domainSuffix)
		}

DEFAULT_PROXY_CONFIG="
serviceCluster: $SVC
controlPlaneAuthPolicy: ${CONTROL_PLANE_AUTH_POLICY}
"
if [ -n "${CUSTOM_PILOT_ADDRESS}" ]; then
  PROXY_CONFIG="$PROXY_CONFIG
discoveryAddress: ${CUSTOM_PILOT_ADDRESS}
"
fi

# PROXY_CONFIG > PILOT_ADDRESS > ISTIO_PILOT_PORT
export PROXY_CONFIG=${PROXY_CONFIG:-${DEFAULT_PROXY_CONFIG}}

if [ "${EXEC_USER}" == "${USER:-}" ] ; then

}

func RuntimeFlags(flags map[string]any) Instance {
	return newOptionOrSkipIfZero("runtime_flags", flags).withConvert(jsonConverter(flags))
}

func DiscoveryAddress(value string) Instance {
	return newOption("discovery_address", value)
}

func XDSRootCert(value string) Instance {
	return newOption("xds_root_cert", value)
}

func Localhost(value LocalhostValue) Instance {

	caProviderEnv = env.Register("CA_PROVIDER", "Citadel", "name of authentication provider").Get()
	caEndpointEnv = env.Register("CA_ADDR", "", "Address of the spiffe certificate provider. Defaults to discoveryAddress").Get()

	trustDomainEnv = env.Register("TRUST_DOMAIN", "cluster.local",
		"The trust domain for spiffe certificates").Get()

	secretTTLEnv = env.Register("SECRET_TTL", 24*time.Hour,

a new one will be generated on demand.

## Configuration

| Variable | Description |
| - | - |
|CA_ADDR|Address of CA, defaults to discoveryAddress|
|CA_PROVIDER|Type of CA; supported values are GoogleCA or Citadel (although anything but GoogleCA will use Citadel); defaults to Citadel|

config_path:               "/etc/istio/proxy"
binary_path:               "/usr/local/bin/envoy"
service_cluster:           "istio-proxy"
drain_duration:            {seconds: 2}
discovery_address:         "istio-pilot:15010"
proxy_admin_port:          15000
control_plane_auth_policy: NONE

config_path:               "/etc/istio/proxy"
binary_path:               "/usr/local/bin/envoy"
service_cluster:           "istio-proxy"
drain_duration:            {seconds: 2}
discovery_address:         "istio-pilot:15011"
proxy_admin_port:          15000
control_plane_auth_policy: MUTUAL_TLS

config_path:               "/etc/istio/proxy"
binary_path:               "/usr/local/bin/envoy"
service_cluster:           "istio-proxy"
drain_duration:            {seconds: 2}
discovery_address:         "istio-pilot:15010"
proxy_admin_port:          15000
control_plane_auth_policy: NONE

config_path:               "/etc/istio/proxy"
binary_path:               "/usr/local/bin/envoy"
service_cluster:           "istio-proxy"
drain_duration:            {seconds: 2}
discovery_address:         "istio-pilot:15010"
proxy_admin_port:          15000
control_plane_auth_policy: NONE
tracing:                   { zipkin: { address: "localhost:6000" }, tls_settings: { mode: SIMPLE, ca_certificates: "/etc/zipkin/ca.pem"}}

config_path:               "/etc/istio/proxy"
binary_path:               "/usr/local/bin/envoy"
service_cluster:           "istio-proxy"
drain_duration:            {seconds: 2}
discovery_address:         "istio-pilot:15010"
proxy_admin_port:          15000
control_plane_auth_policy: NONE
tracing:                   { zipkin: { address: "localhost:6000" }, tls_settings: { mode: SIMPLE, ca_certificates: "/etc/zipkin/ca.pem", sni: "zipkin-custom-sni"}}