},
    {
      "sysctl": {
        "net.core.somaxconn": "500"
      },
      "type": "tuning"
    },
    {
      "kubernetes": {
        "cni_bin_dir": "/path/cni/bin",
        "kubeconfig": "/path/to/kubeconfig"
      },
      "name": "istio-cni",
      "plugin_log_level": "debug",
      "type": "istio-cni"
    }
  ]

		optionalKubeConfigSentence = " This is optional. If empty, all requests not skipped by authorization are forbidden."
	}
	fs.StringVar(&s.RemoteKubeConfigFile, "authorization-kubeconfig", s.RemoteKubeConfigFile,
		"kubeconfig file pointing at the 'core' kubernetes server with enough rights to create "+
			"subjectaccessreviews.authorization.k8s.io."+optionalKubeConfigSentence)

    {
      "ambient_enabled": false,
      "cni_event_address": "",
      "dns": {},
      "ipam": {},
      "kubernetes": {
        "exclude_namespaces": [
          ""
        ],
        "kubeconfig": "/path/to/kubeconfig"
      },
      "log_uds_address": "",
      "name": "istio-cni",
      "plugin_log_level": "debug",
      "type": "istio-cni"
    }
  ]

      value: {{kubectl_prune_whitelist_override}}
    - name: KUBECTL_EXTRA_PRUNE_WHITELIST
      value: {{kubectl_extra_prune_whitelist}}
    - name: KUBECTL_OPTS
      value: '--kubeconfig=/etc/srv/kubernetes/addon-manager/kubeconfig'
  volumes:
  - hostPath:
      path: /etc/kubernetes/
    name: addons
  - hostPath:
      path: /var/log
    name: varlog
  - hostPath:
      path: /etc/srv/kubernetes/addon-manager/

				}
				return
			}
			if err != nil {
				t.Fatal(err)
			}
			if kubeconfig != tc.expectKubeconfig {
				t.Fatalf("expected %q, got %q", tc.expectKubeconfig, kubeconfig)
			}
		})
	}

              path: istio-token
      - name: cacerts
        secret:
          optional: true
          secretName: cacerts
      - name: istio-kubeconfig
        secret:
          optional: true
          secretName: istio-kubeconfig
      - name: istio-csr-dns-cert
        secret:
          optional: true
          secretName: istiod-tls
      - configMap:
          defaultMode: 420

	klog.V(1).Infoln("[bootstrap-token] loading admin kubeconfig")
	adminConfig, err := clientcmd.LoadFromFile(file)
	if err != nil {
		return errors.Wrap(err, "failed to load admin kubeconfig")
	}
	if err = clientcmdapi.FlattenConfig(adminConfig); err != nil {
		return err
	}

)

// AddKubeConfigFlag adds the --kubeconfig flag to the given flagset
func AddKubeConfigFlag(fs *pflag.FlagSet, kubeConfigFile *string) {
	fs.StringVar(kubeConfigFile, KubeconfigPath, *kubeConfigFile, "The kubeconfig file to use when talking to the cluster. If the flag is not set, a set of standard locations can be searched for an existing kubeconfig file.")

		"--etcd-prefix", uuid.New().String(),
		"--etcd-servers", strings.Join(IntegrationEtcdServers(), ","),
		"--authentication-skip-lookup",
		"--authentication-kubeconfig", fakeKubeConfig.Name(),
		"--authorization-kubeconfig", fakeKubeConfig.Name(),
		"--kubeconfig", fakeKubeConfig.Name(),
		// disable admission and filters that require talking to kube-apiserver
		"--enable-priority-and-fairness=false",

		}
	}
	return nil
}

// Invoke implements Instance
func (c *kubeComponent) Invoke(args []string) (string, string, error) {
	cmdArgs := append([]string{
		"--kubeconfig",
		c.kubeconfig,
	}, args...)

	var out bytes.Buffer
	var err bytes.Buffer

	start := time.Now()

	invokeMutex.Lock()
	rootCmd := cmd.GetRootCmd(cmdArgs)
	rootCmd.SetOut(&out)
	rootCmd.SetErr(&err)