FROM ${ISTIO_BASE_REGISTRY}/base:${BASE_VERSION}

ARG TARGETARCH
COPY ${TARGETARCH:-amd64}/client /usr/local/bin/client
COPY ${TARGETARCH:-amd64}/server /usr/local/bin/server
COPY certs/cert.crt /cert.crt
COPY certs/cert.key /cert.key

# Add a user that will run the application. This allows running as this user and capture iptables
RUN useradd -m --uid 1338 application
USER 1338

	}
	got := xdstest.ExtractTLSSecrets(s.t, resp.Resources)
	for _, e := range expectations {
		scrt := got[e.ResourceName]
		var expectationKey []byte
		if provider := scrt.GetTlsCertificate().GetPrivateKeyProvider(); provider != nil {
			expectationKey = s.extractPrivateKeyProvider(provider)
		} else {
			expectationKey = scrt.GetTlsCertificate().GetPrivateKey().GetInlineBytes()
		}
		r := Expectation{

		"--etcd-certfile=/var/run/kubernetes/etcdce.crt",
		"--etcd-cafile=/var/run/kubernetes/etcdca.crt",
		"--http2-max-streams-per-connection=42",
		"--kubelet-read-only-port=10255",
		"--kubelet-timeout=5s",
		"--kubelet-client-certificate=/var/run/kubernetes/ceserver.crt",
		"--kubelet-client-key=/var/run/kubernetes/server.key",
		"--kubelet-certificate-authority=/var/run/kubernetes/caserver.crt",

					Prefix: "/registry",
					Transport: storagebackend.TransportConfig{
						ServerList:    nil,
						KeyFile:       "/var/run/kubernetes/etcd.key",
						TrustedCAFile: "/var/run/kubernetes/etcdca.crt",
						CertFile:      "/var/run/kubernetes/etcdce.crt",
					},
					CompactionInterval:    storagebackend.DefaultCompactInterval,
					CountMetricPollPeriod: time.Minute,
				},
				DefaultStorageMediaType: "application/vnd.kubernetes.protobuf",

          - "17070"
          - --grpc
          - "17171"
          - --port
          - "3333"
          - --port
          - "8080"
          - --version
          - v1
          - --crt=/cert.crt
          - --key=/cert.key
          env:
          - name: INSTANCE_IP
            valueFrom:
              fieldRef:
                apiVersion: v1
                fieldPath: status.podIP

---
apiVersion: v1
kind: Secret
metadata:
  name: jwt-cert-key-secret
# command to generate certificate
# use the generated server.crt, server.key by following https://github.com/istio/istio/blob/master/samples/jwt-server/testdata/README.MD
stringData: 
  server.crt: |
    -----BEGIN CERTIFICATE-----
    MIIDjzCCAnegAwIBAgIUfIuuQDfWakIpZ7bZAuuLUWhSm2AwDQYJKoZIhvcNAQEL

          - --metrics=15014
          - --cluster=cluster-0
          - --grpc=7070
          - --port=8080
          - --port=3333
          - --version=v1
          - --istio-version=
          - --crt=/cert.crt
          - --key=/cert.key
        ports:
        - containerPort: 7070
        - containerPort: 8080
        - containerPort: 3333
          name: tcp-health-port
        env:
        - name: INSTANCE_IP

	_, err = os.Stat(path.Join(dir, "ca.crt"))
	g.Expect(os.IsNotExist(err)).Should(Equal(true))

	// Should load remote cacerts successfully.
	createCATLSSecret(t, s.kubeClient)

	err = s.loadCACerts(caOpts, dir)
	g.Expect(err).Should(BeNil())

	expectedRoot, err := readSampleCertFromFile("root-cert.pem")
	g.Expect(err).Should(BeNil())

	g.Expect(os.ReadFile(path.Join(dir, "ca.crt"))).Should(Equal(expectedRoot))

          - --cluster=cluster-0
          - --grpc=7070
          - --port=8090
          - --port=8080
          - --port=3333
          - --version=bar
          - --istio-version=
          - --crt=/cert.crt
          - --key=/cert.key
        ports:
        - containerPort: 7070
        - containerPort: 8090
        - containerPort: 8080
        - containerPort: 3333
          name: tcp-health-port
        env:

          - --cluster=cluster-0
          - --grpc=7070
          - --port=8090
          - --port=8080
          - --port=3333
          - --version=bar
          - --istio-version=
          - --crt=/cert.crt
          - --key=/cert.key
        ports:
        - containerPort: 7070
        - containerPort: 8090
        - containerPort: 8080
        - containerPort: 3333
          name: tcp-health-port
        env: