cloudprovider.DisableWarningForProvider(cloudProvider)
		return nil, fmt.Errorf("cloud provider %q was specified, but built-in cloud providers are disabled. Please set --cloud-provider=external and migrate to an external cloud provider", cloudProvider)
	}

	var nodeHasSynced cache.InformerSynced
	var nodeLister corelisters.NodeLister

		AccessLogging: []*tpb.AccessLogging{
			{
				Providers: []*tpb.ProviderRef{
					{
						Name: "custom-provider",
					},
				},
			},
		},
	}
	multiAccessLogging := &tpb.Telemetry{
		AccessLogging: []*tpb.AccessLogging{
			{
				Providers: []*tpb.ProviderRef{
					{
						Name: "envoy",
					},
				},
			},
			{
				Providers: []*tpb.ProviderRef{
					{

		Metrics: []*tpb.Metrics{
			{
				Providers: []*tpb.ProviderRef{{Name: "prometheus"}},
			},
		},
	}
	overridesPrometheus := &tpb.Telemetry{
		Metrics: []*tpb.Metrics{
			{
				Providers: []*tpb.ProviderRef{{Name: "prometheus"}},
				Overrides: overrides,
			},
		},
	}
	reportingInterval := &tpb.Telemetry{
		Metrics: []*tpb.Metrics{
			{
				Providers:         []*tpb.ProviderRef{{Name: "prometheus"}},

}

func openTelemetryLog(pushCtx *PushContext,
	provider *meshconfig.MeshConfig_ExtensionProvider_EnvoyOpenTelemetryLogProvider,
) *accesslog.AccessLog {
	hostname, cluster, err := clusterLookupFn(pushCtx, provider.Service, int(provider.Port))
	if err != nil {
		IncLookupClusterFailures("envoyOtelAls")
		log.Errorf("could not find cluster for open telemetry provider %q: %v", provider, err)
		return nil
	}

		},
		Spec: &tpb.Telemetry{
			Selector: &v1beta1.WorkloadSelector{
				MatchLabels: map[string]string{
					"app": "test",
				},
			},
			AccessLogging: []*tpb.AccessLogging{
				{
					Providers: []*tpb.ProviderRef{
						{
							Name: "envoy-json",
						},
					},
				},
			},
		},
	})
	configStore.Create(config.Config{
		Meta: config.Meta{

	return ShardKey{Cluster: instance.Cluster(), Provider: instance.Provider()}
}

// ShardKey is the key for EndpointShards made of a key with the format "provider/cluster"
type ShardKey struct {
	Cluster  cluster.ID
	Provider provider.ID
}

func (sk ShardKey) String() string {
	return string(sk.Provider) + "/" + string(sk.Cluster) // format: %s/%s
}

	"istio.io/istio/pilot/pkg/features"
	"istio.io/istio/pilot/pkg/model"
	"istio.io/istio/pilot/pkg/networking/core/envoyfilter"
	"istio.io/istio/pilot/pkg/networking/util"
	"istio.io/istio/pilot/pkg/serviceregistry/provider"
	"istio.io/istio/pilot/pkg/util/protoconv"
	"istio.io/istio/pilot/pkg/xds/endpoints"
	"istio.io/istio/pkg/config/host"
	"istio.io/istio/pkg/config/protocol"
	"istio.io/istio/pkg/config/schema/kind"

      "cloud.google.com/go/firestore": "db/datastore clients should not be required",
      "cloud.google.com/go/storage": "cloud dependency",
      "github.com/GoogleCloudPlatform/k8s-cloud-provider": "cloud dependency",
      "github.com/PuerkitoBio/urlesc": "unmaintained, archive mode",
      "github.com/armon/consul-api": "MPL license not in CNCF allowlist",
      "github.com/bketelsen/crypt": "unused, crypto",

	defaultCACertPath = "./var/run/secrets/kubernetes.io/serviceaccount/ca.crt"
)

// initDNSCertsK8SRA will create the certificates using K8S RA.
// Only called by initIstiodCerts if provider (PILOT_CERT_PROVIDER) has k8s.io prefix
// and local certificates are not found.
//
// The roots are loaded from mesh config.
func (s *Server) initDNSCertsK8SRA() error {
	var certChain, keyPEM, caBundle []byte

		// There are multiple role ARNs for parent user only when there
		// are multiple openid provider configurations with the same ID
		// provider. We lookup the provider associated with some one of
		// the roleARNs to check if the user still exists. If they don't
		// we can safely remove credentials for this parent user
		// associated with any of the provider configurations.
		//
		// If there is no roleARN mapped to the user, the user may be