// manualSelector controls generation of pod labels and pod selectors.
  // Leave `manualSelector` unset unless you are certain what you are doing.
  // When false or unset, the system pick labels unique to this job
  // and appends those labels to the pod template.  When true,
  // the user is responsible for picking unique labels and specifying
  // the selector.  Failure to pick a unique label may cause this

                      description: The maximum amount of time that the resolver, determined
                        by the PILOT_JWT_ENABLE_REMOTE_JWKS environment variable,
                        will spend waiting for the JWKS to be fetched.
                      type: string
                  required:
                  - issuer
                  type: object
                type: array

                        },
                        "server_name": "istio-envoy",
                        "use_remote_address": false,
                        "forward_client_cert_details": "APPEND_FORWARD",
                        "set_current_client_cert_details": {
                          "subject": true,
                          "dns": true,
                          "uri": true
                        },

  // a single IP family on single-stack clusters), or "RequireDualStack"
  // (two IP families on dual-stack configured clusters, otherwise fail). The
  // ipFamilies and clusterIPs fields depend on the value of this field. This
  // field will be wiped when updating a service to type ExternalName.
  // +optional
  optional string ipFamilyPolicy = 17;

	msgs := diag.Messages{}

	m, err := checkServerVersion(cli)
	if err != nil {
		return nil, err
	}
	msgs = append(msgs, m...)

	msgs = append(msgs, checkInstallPermissions(cli, ctx.IstioNamespace())...)
	gwMsg, err := checkGatewayAPIs(cli)
	if err != nil {
		return nil, err
	}
	msgs = append(msgs, gwMsg...)

	// TODO: add more checks

	sa := local.NewSourceAnalyzer(

				}
				meta, err := model.ParseMetadata(node.Metadata)
				if err != nil || meta.ProxyConfig == nil {
					// Skip non-sidecars (e.g. istioctl queries)
					continue
				}
				pi = append(pi, istioVersion.ProxyInfo{
					ID:           node.Id,
					IstioVersion: getIstioVersionFromXdsMetadata(node.Metadata),
				})
			case "type.googleapis.com/envoy.service.status.v3.ClientConfig":

	var commandStack []*cobra.Command

	commandStack = append(commandStack, rootCmd)

	for len(commandStack) > 0 {
		n := len(commandStack) - 1
		curCmd := commandStack[n]
		commandStack = commandStack[:n]
		seenCommands[curCmd] = true
		for _, command := range curCmd.Commands() {
			if !seenCommands[command] {
				commandStack = append(commandStack, command)
			}
		}

			checks:   append([]assertion{{empty, empty, "istiod"}}, baseAssertions...),
		},
		{
			// Upgrade from a legacy webhook to a new revision based
			// Note: we don't need non revision legacy -> non revision, since it will overwrite the webhook
			name:     "revision upgrade",
			webhooks: mergeWebhooks(legacyWebhook, revWebhook),
			checks: append([]assertion{

	we := wg.Spec.Template
	ports := []string{}
	for _, v := range we.Ports {
		ports = append(ports, fmt.Sprint(v))
	}
	// respect the inbound port annotation and capture all traffic if no inbound ports are set
	portBehavior := "*"
	if len(ports) > 0 {
		portBehavior = strings.Join(ports, ",")
	}

// the DaemonSet and StatefulSet controllers for update and rollback, this object is beta. However,
// it may be subject to name and representation changes in future releases, and clients should not
// depend on its stability. It is primarily for internal use by controllers.
message ControllerRevision {
  // Standard object's metadata.