portLevelMtls:
    9090:
      mode: PERMISSIVE
```

will be translated into this `Authorization`:

```yaml
action: DENY
groups:
- rules:
  - matches:
    - notPrincipals:
      - presence: {}
- rules:
  - matches:
    - notDestinationPorts:
      - 9090
name: converted_peer_authentication_strict-and-permissive-mtls
scope: WORKLOAD_SELECTOR
```

"This is not json"

    app: sidecar-injector
    release: {{ .Release.Name }}
webhooks:
{{- /* Set up the selectors. First section is for revision, rest is for "default" revision */}}

{{- /* Case 1: namespace selector matches, and object doesn't disable */}}
{{- /* Note: if both revision and legacy selector, we give precedence to the legacy one */}}
{{- include "core" (mergeOverwrite (deepCopy $whv) (dict "Prefix" "rev.namespace.") ) }}

message PodFailurePolicy {
  // A list of pod failure policy rules. The rules are evaluated in order.
  // Once a rule matches a Pod failure, the remaining of the rules are ignored.
  // When no rule matches the Pod failure, the default handling applies - the
  // counter of pod failures is incremented and it is checked against
  // the backoffLimit. At most 20 elements are allowed.

                            of the authorized client certificates.
                          items:
                            type: string
                          type: array
                        verifyCertificateSpki:
                          description: An optional list of base64-encoded SHA-256
                            hashes of the SPKIs of authorized client certificates.

	"google.golang.org/protobuf/proto"

	"istio.io/istio/pkg/log"
	"istio.io/istio/pkg/wellknown"
)

const (
	anonymousName = "_anonymous_match_nothing_"
)

// Matches the policy name in RBAC filter config with format like ns[default]-policy[some-policy]-rule[1].
var re = regexp.MustCompile(`ns\[(.+)\]-policy\[(.+)\]-rule\[(.+)\]`)

type filterChain struct {
	rbacHTTP []*rbachttp.RBAC

	if diff != "" {
		fmt.Printf("Differences in manifests are:\n%s\n", diff)
		return false, nil
	}

	fmt.Println("Manifests are identical")
	return true, nil
}

func yamlFileFilter(path string) bool {
	return filepath.Ext(path) == YAMLSuffix
}

// compareManifestsFromDirs compares manifests from two directories
func compareManifestsFromDirs(verbose bool, dirName1, dirName2,

type ClusterFilter struct {
	FQDN      host.Name
	Port      int
	Subset    string
	Direction model.TrafficDirection
}

// Verify returns true if the passed cluster matches the filter fields
func (c *ClusterFilter) Verify(cluster *cluster.Cluster) bool {
	name := cluster.Name
	if c.FQDN == "" && c.Port == 0 && c.Subset == "" && c.Direction == "" {
		return true
	}

// See the License for the specific language governing permissions and
// limitations under the License.

// This is a sample chained plugin that supports multiple CNI versions. It
// parses prevResult according to the cniVersion
package plugin

import (
	"fmt"

	"github.com/containernetworking/plugins/pkg/ns"

	"istio.io/istio/pkg/log"
	"istio.io/istio/tools/istio-iptables/pkg/cmd"

)

type profileDumpArgs struct {
	// inFilenames is an array of paths to the input IstioOperator CR files.
	inFilenames []string
	// configPath sets the root node for the subtree to display the config for.
	configPath string
	// outputFormat controls the format of profile dumps
	outputFormat string
	// manifestsPath is a path to a charts and profiles directory in the local filesystem with a release tgz.
	manifestsPath string