// Configures whether to use an existing CNI installation for workloads
  CNIUsageConfig cni = 55;

  PilotTaintControllerConfig taint = 57;

  // If set, `istiod` will allow connections from trusted node proxy ztunnels
  // in the provided namespace.
  string trustedZtunnelNamespace = 59;
}

message PilotTaintControllerConfig {
  // Enable the untaint controller for new nodes. This aims to solve a race for CNI installation on 

		return nil, badStringError("malformed HTTP version", req.Proto)
	}

	// CONNECT requests are used two different ways, and neither uses a full URL:
	// The standard use is to tunnel HTTPS through an HTTP proxy.
	// It looks like "CONNECT www.google.com:443 HTTP/1.1", and the parameter is
	// just the authority section of a URL. This information should go in req.URL.Host.
	//

                              items:
                                type: string
                              type: array
                          type: object
                        tunnel:
                          description: Configuration of tunneling TCP over other transport
                            or application layers for the host configured in the DestinationRule.
                          properties:

  - kind: Service
    group: core
    name: "{{ .Destination }}"
`+tc.spec+`
---
apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: policy
spec:
  # affects zTunnels and Sidecars
  selector:
    matchLabels:
      app: "{{ .Destination }}"
`+tc.spec).ApplyOrFail(t)
					perCaseOpt := opt.DeepCopy()
					perCaseOpt.Check = tc.check
					overrideCheck(src, dst, &perCaseOpt)

	if n--; n == 0 {
		delete(t.connsPerHost, key)
	} else {
		t.connsPerHost[key] = n
	}
}

// Add TLS to a persistent connection, i.e. negotiate a TLS session. If pconn is already a TLS
// tunnel, this function establishes a nested TLS session inside the encrypted channel.
// The remote endpoint's name may be overridden by TLSClientConfig.ServerName.

	Taint *PilotTaintControllerConfig `protobuf:"bytes,57,opt,name=taint,proto3" json:"taint,omitempty"`
	// If set, `istiod` will allow connections from trusted node proxy ztunnels
	// in the provided namespace.
	TrustedZtunnelNamespace string `protobuf:"bytes,59,opt,name=trustedZtunnelNamespace,proto3" json:"trustedZtunnelNamespace,omitempty"`
}

func (x *PilotConfig) Reset() {

							Type:        []string{"array"},
							Items: &spec.SchemaOrArray{
								Schema: &spec.Schema{

github.com/stretchr/testify
https://github.com/stretchr/testify
----------------------------------------------------------------
MIT License

Copyright (c) 2012-2020 Mat Ryer, Tyler Bunnell and contributors.

Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal

          "items": {
            "type": "string"
          },
          "type": "array",