- "-c"
    - "{{ index .ObjectMeta.Annotations `traffic.sidecar.istio.io/excludeInterfaces` }}"
    {{ end -}}
    - "--log_output_level={{ annotation .ObjectMeta `sidecar.istio.io/agentLogLevel` .Values.global.logging.level }}"
    {{ if .Values.global.logAsJson -}}
    - "--log_as_json"
    {{ end -}}
    {{ if or .Values.pilot.cni.enabled .Values.istio_cni.enabled -}}
    - "--run-validation"

    - "-c"
    - "{{ index .ObjectMeta.Annotations `traffic.sidecar.istio.io/excludeInterfaces` }}"
    {{ end -}}
    - "--log_output_level={{ annotation .ObjectMeta `sidecar.istio.io/agentLogLevel` .Values.global.logging.level }}"
    {{ if .Values.global.logAsJson -}}
    - "--log_as_json"
    {{ end -}}
    {{ if or .Values.pilot.cni.enabled .Values.istio_cni.enabled -}}
    - "--run-validation"

			wantException:    true,
		},
		{ // logger name valid and logging level valid
			execClientConfig: loggingConfig,
			args:             strings.Split("log ztunnel-9v7nw --level ztunnel::pool:debug", " "),
			expectedString:   "",
			wantException:    false,
		},
		{ // set ztunnel logging level
			execClientConfig: loggingConfig,
			args:             strings.Split("log ztunnel-9v7nw --level debug", " "),

  // Additional policies may be added in the future.
  // Clients making eviction decisions should disallow eviction of unhealthy pods
  // if they encounter an unrecognized policy in this field.
  //
  // This field is beta-level. The eviction API uses this field when
  // the feature gate PDBUnhealthyPodEvictionPolicy is enabled (enabled by default).
  // +optional
  optional string unhealthyPodEvictionPolicy = 4;
}

   Matching subsets: 
      (Non-matching subsets v1)
   Traffic Policy TLS Mode: ISTIO_MUTUAL
   Policies: load balancer/connection pool/outlier detection
   Port Level Settings:
    8080:
      TLS Mode: DISABLE
      Policies: load balancer/connection pool/outlier detection
VirtualService: bookinfo
   Route to host "productpage" with weight 30%

  // Standard object's metadata.
  // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;

  // Specification of the desired behavior of a cron job, including the schedule.
  // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
  // +optional

		},
		{ // logging level invalid
			execClientConfig: loggingConfig,
			args:             strings.Split("log details-v1-5b7f94f9bc-wp5tb --level xxx", " "),
			expectedString:   "unrecognized logging level: xxx",
			wantException:    true,
		},
		{ // logger name invalid
			execClientConfig: loggingConfig,
			args:             strings.Split("log details-v1-5b7f94f9bc-wp5tb --level xxx:debug", " "),

  // is populated only for the CSIMigration feature. It contains
  // translated fields from a pod's inline VolumeSource to a
  // PersistentVolumeSpec. This field is alpha-level and is only
  // honored by servers that enabled the CSIMigration feature.
  // +optional
  optional k8s.io.api.core.v1.PersistentVolumeSpec inlineVolumeSpec = 2;
}

defaults:
  cni:
    hub: ""
    tag: ""
    variant: ""
    image: install-cni
    pullPolicy: ""

    # Configuration log level of istio-cni binary
    # by default istio-cni send all logs to UDS server
    # if want to see them you need change global.logging.level with cni:debug
    logLevel: debug

    # Configuration file to insert istio-cni plugin configuration
    # by default this will be the first file found in the cni-conf-dir

  // If any of the selectors match, then the ClusterRole's permissions will be added
  // +optional
  repeated k8s.io.apimachinery.pkg.apis.meta.v1.LabelSelector clusterRoleSelectors = 1;
}

// ClusterRole is a cluster level, logical grouping of PolicyRules that can be referenced as a unit by a RoleBinding or ClusterRoleBinding.
message ClusterRole {
  // Standard object's metadata.
  // +optional