cfg.ServiceLabels = make(map[string]string)
		}
		cfg.ServiceLabels[constants.AmbientUseWaypointLabel] = cfg.ServiceWaypointProxy
	}
	return map[string]any{
		"Service":        cfg.Service,
		"Headless":       cfg.Headless,
		"ServiceAccount": cfg.ServiceAccount,
		"ServicePorts":   cfg.Ports.GetServicePorts(),
		"ServiceLabels":  cfg.ServiceLabels,
		"IPFamilies":     cfg.IPFamilies,
		"IPFamilyPolicy": cfg.IPFamilyPolicy,

	// Only use CertificateValidityPeriod as CA renewal is not supported.
	if rm.cfg.CertificateValidityPeriod != nil {
		cfg.NotAfter = startTime.Add(rm.cfg.CertificateValidityPeriod.Duration)
	}

	// reads the CA
	caCert, caKey, err := certsphase.LoadCertificateAuthority(rm.cfg.CertificatesDir, handler.CABaseName)
	if err != nil {
		return false, err
	}

	// create a new certificate with the same config

	cfg := config.DefaultConfig()
	cfg.CNIMode = true
	cfg.NetworkNamespace = netns
	cfg.ProxyPort = rdrct.targetPort
	cfg.ProxyUID = rdrct.noRedirectUID
	cfg.ProxyGID = rdrct.noRedirectGID
	cfg.InboundInterceptionMode = rdrct.redirectMode
	cfg.OutboundIPRangesInclude = rdrct.includeIPCidrs
	cfg.InboundPortsExclude = rdrct.excludeInboundPorts
	cfg.InboundPortsInclude = rdrct.includeInboundPorts

	if err != nil {
		return cfg, err
	}

	cfg.HSTSSeconds = hstsSeconds
	cfg.HSTSIncludeSubdomains = hstsIncludeSubdomains
	cfg.HSTSPreload = hstsPreload

	referrerPolicy := env.Get(EnvBrowserReferrerPolicy, kvs.GetWithDefault(browserReferrerPolicy, DefaultKVS))
	switch referrerPolicy {

	if d == "" {
		cfg.MaxTimeout = 30 * time.Second
	} else {
		dur, _ := time.ParseDuration(d)
		if dur < time.Second {
			cfg.MaxTimeout = 30 * time.Second
		} else {
			cfg.MaxTimeout = getMaxTimeout(dur)
		}
	}
	return cfg, err
}

func getMaxTimeout(t time.Duration) time.Duration {
	if t > time.Second {
		return t
	}
	// get default value

	switch cfg.Version {
	case "29":
		// V29 -> V30
		cfg.Compression.Enabled = false
		cfg.Compression.Extensions = strings.Split(compress.DefaultExtensions, config.ValueSeparator)
		cfg.Compression.MimeTypes = strings.Split(compress.DefaultMimeTypes, config.ValueSeparator)
	case "30":
		// V30 -> V31
		cfg.OpenID = openid.Config{}
		cfg.Policy.OPA = opa.Args{
			URL:       &xnet.URL{},

		return nil
	}

	cfg := TranslateObject(obj, typ, cl.domainSuffix)
	return &cfg
}

// Create implements store interface
func (cl *Client) Create(cfg config.Config) (string, error) {
	if cfg.Spec == nil {
		return "", fmt.Errorf("nil spec for %v/%v", cfg.Name, cfg.Namespace)
	}

	meta, err := create(cl.client, cfg, getObjectMetadata(cfg))
	if err != nil {
		return "", err
	}

			cfg.S3.AccessKey = creds.AccessKey
			cfg.S3.SecretKey = creds.SecretKey
		}
	case madmin.Azure:
		if creds.SecretKey != "" {
			cfg.Azure.AccountKey = creds.SecretKey
		}
		if creds.AzSP.TenantID != "" {
			cfg.Azure.SPAuth.TenantID = creds.AzSP.TenantID
		}
		if creds.AzSP.ClientID != "" {
			cfg.Azure.SPAuth.ClientID = creds.AzSP.ClientID
		}
		if creds.AzSP.ClientSecret != "" {

	*completedConfig
}

func (c *Config) Complete() CompletedConfig {
	cfg := completedConfig{
		c.Generic.Complete(c.VersionedInformers),
		&c.Extra,
	}

	discoveryAddresses := discovery.DefaultAddresses{DefaultAddress: cfg.Generic.ExternalAddress}
	cfg.Generic.DiscoveryAddresses = discoveryAddresses

	if cfg.Extra.PeerEndpointReconcileInterval == 0 {
		cfg.Extra.PeerEndpointReconcileInterval = DefaultPeerEndpointReconcileInterval
	}

			if err := cfg.FillConfigFromEnvironment(); err != nil {
				handleErrorWithCode(err, 1)
			}
			if err := cfg.Validate(); err != nil {
				handleErrorWithCode(err, 1)
			}
			if err := ProgramIptables(cfg); err != nil {
				handleErrorWithCode(err, 1)
			}

			if cfg.RunValidation {
				validator := validation.NewValidator(cfg)

				if err := validator.Run(); err != nil {