t.Fatalf("expected failure")
			}

			goldenFilepath := "testdata/kubeconfig-tls"
			if c.skipTLSVerify {
				goldenFilepath = "testdata/kubeconfig-skip-tls"
			}

			testutils.CompareContent(t, []byte(result.Full), goldenFilepath)
		})
	}
}

func TestReplaceInvalidKubeconfigFile(t *testing.T) {
	tmp := t.TempDir()
	os.WriteFile(filepath.Join(tmp, "token"), []byte(saToken), 0o644)
	constants.ServiceAccountPath = tmp

  // +optional
  repeated string resourceNames = 5;

  // NonResourceURLs is a set of partial urls that a user should have access to.  *s are allowed, but only as the full, final step in the path
  // Since non-resource URLs are not namespaced, this field is only applicable for ClusterRoles referenced from a ClusterRoleBinding.

  // +optional
  repeated string resourceNames = 4;

  // NonResourceURLs is a set of partial urls that a user should have access to.  *s are allowed, but only as the full, final step in the path
  // Since non-resource URLs are not namespaced, this field is only applicable for ClusterRoles referenced from a ClusterRoleBinding.

// the related backend services. Incoming requests are first evaluated for a host
// match, then routed to the backend associated with the matching IngressRuleValue.
message IngressRule {
  // Host is the fully qualified domain name of a network host, as defined by RFC 3986.
  // Note the following deviations from the "host" part of the
  // URI as defined in RFC 3986:

  // remove the pod from the API. In the presence of network partitions, this object may still
  // exist after this timestamp, until an administrator or automated process can determine the
  // resource is fully terminated.
  // If not set, graceful deletion of the object has not been requested.
  //
  // Populated by the system when a graceful deletion is requested.
  // Read-only.

	}

	return copiedFiles, nil
}

// Run starts the installation process, verifies the configuration, then sleeps.
// If the configuration is invalid, a full redeployal of config, binaries, and svcAcct credentials to the
// shared node CNI dir will be attempted.
//
// If changes occurred but the config is still valid, only the binaries and (optionally) svcAcct credentials

    autoscaleMin: 1
    autoscaleMax: 5
    autoscaleBehavior: {}
    replicaCount: 1
    rollingMaxSurge: 100%
    rollingMaxUnavailable: 25%
    hub: ""
    tag: ""
    variant: ""
    # Can be a full hub/image:tag
    image: pilot
    traceSampling: 1.0
    # Resources for a small pilot install
    resources:
      requests:
        cpu: 500m
        memory: 2048Mi

	return f.full.UnstructuredClientForMapping(mapping)
}

func (f Factory) Validator(validationDirective string) (validation.Schema, error) {
	return f.full.Validator(validationDirective)
}

func (f Factory) OpenAPISchema() (openapi.Resources, error) {
	return f.full.OpenAPISchema()
}

func (f Factory) OpenAPIV3Client() (openapiclient.Client, error) {
	return f.full.OpenAPIV3Client()
}

var _ util.Factory = Factory{}

	"sigs.k8s.io/yaml"

	"istio.io/istio/cni/pkg/config"
	"istio.io/istio/cni/pkg/constants"
	"istio.io/istio/pilot/pkg/model"
	"istio.io/istio/pkg/file"
)

type kubeconfig struct {
	// The full kubeconfig
	Full string
	// Kubeconfig with confidential data redacted.
	Redacted string
}

func createKubeConfig(cfg *config.InstallConfig) (kubeconfig, error) {
	if len(cfg.K8sServiceHost) == 0 {

{{- else if .Values.cni.repair.deletePods }}
  - apiGroups: [""]
    resources: ["pods"]
    verbs: ["delete"]
{{- else if .Values.cni.repair.labelPods }}
  - apiGroups: [""]
    {{- /* pods/status is less privileged than the full pod, and either can label. So use the lower pods/status */}}
    resources: ["pods/status"]
    verbs: ["patch", "update"]
{{- end }}
{{- end }}
---
{{- if .Values.cni.ambient.enabled }}