copyFile("./testdata/mycertinvalid.crt", fileDir+"/mycertinvalid.crt")
	copyFile("./testdata/mycertvalid.crt", fileDir+"/mycertvalid.crt")
	copyFile("./testdata/mycertinvalid.key", fileDir+"/mycertinvalid.key")
	copyFile("./testdata/mycertvalid.key", fileDir+"/mycertvalid.key")
	testDataValid := []byte(`
apiVersion: v1
kind: Config
clusters:
- cluster:
    certificate-authority: ca-a.crt
    server: https://cluster-a.com

			expectedCAError: "found secret, but didn't have expected keys cacert or ca.crt; found: tls.crt, tls.key",
		},
		{
			name:          "tls-mtls-split-cacert",
			namespace:     "default",
			caCert:        "tls-mtls-split-ca",
			expectedError: "found secret, but didn't have expected keys (cert and key) or (tls.crt and tls.key); found: ca.crt",
		},
		{
			name:          "tls-mtls-split-crl-cacert",

						ClientCAFile: "/foo/ca.crt",
					},
				},
			},
			expected: &kubeletconfig.KubeletConfiguration{
				ResolverConfig: ptr.To(""),
				StaticPodPath:  filepath.Join(drive, "/foo/staticpods"),
				Authentication: kubeletconfig.KubeletAuthentication{
					X509: kubeletconfig.KubeletX509Authentication{
						ClientCAFile: filepath.Join(drive, "/foo/ca.crt"),
					},
				},
			},
		},
		{

          - --metrics=15014
          - --cluster=cluster-0
          - --port=8080
          - --port=3333
          - --grpc=17777
          - --version=bar
          - --istio-version=
          - --crt=/cert.crt
          - --key=/cert.key
        ports:
        - containerPort: 8080
        - containerPort: 3333
          name: tcp-health-port
        - containerPort: 17777
        env:
        - name: INSTANCE_IP

          - --cluster=cluster-0
          - --grpc=7070
          - --port=8090
          - --port=8080
          - --port=3333
          - --version=bar
          - --istio-version=1.8.2
          - --crt=/cert.crt
          - --key=/cert.key
        ports:
        - containerPort: 7070
        - containerPort: 8090
        - containerPort: 8080
        - containerPort: 3333
          name: tcp-health-port
        env:

          - --cluster=cluster-0
          - --grpc=7070
          - --port=8090
          - --port=8080
          - --port=3333
          - --version=v1
          - --istio-version=
          - --crt=/cert.crt
          - --key=/cert.key
        ports:
        - containerPort: 7070
        - containerPort: 8090
        - containerPort: 8080
        - containerPort: 3333
          name: tcp-health-port
        env:

          - --port=8090
          - --tcp=9000
          - --grpc=9090
          - --port=8080
          - --port=3333
          - --version=v-istio
          - --istio-version=
          - --crt=/cert.crt
          - --key=/cert.key
        ports:
        - containerPort: 8090
        - containerPort: 9000
        - containerPort: 9090
        - containerPort: 8080
        - containerPort: 3333

          - --cluster=cluster-0
          - --grpc=7070
          - --port=8090
          - --port=8080
          - --port=3333
          - --version=bar
          - --istio-version=1.9.0
          - --crt=/cert.crt
          - --key=/cert.key
        ports:
        - containerPort: 7070
        - containerPort: 8090
        - containerPort: 8080
        - containerPort: 3333
          name: tcp-health-port
        env:

FROM ${ISTIO_BASE_REGISTRY}/base:${BASE_VERSION}

ARG TARGETARCH
COPY ${TARGETARCH:-amd64}/client /usr/local/bin/client
COPY ${TARGETARCH:-amd64}/server /usr/local/bin/server
COPY certs/cert.crt /cert.crt
COPY certs/cert.key /cert.key

# Add a user that will run the application. This allows running as this user and capture iptables
RUN useradd -m --uid 1338 application
USER 1338

var certFiles = []string{
	"/usr/local/etc/ssl/cert.pem",            // FreeBSD
	"/etc/ssl/cert.pem",                      // OpenBSD
	"/usr/local/share/certs/ca-root-nss.crt", // DragonFly
	"/etc/openssl/certs/ca-certificates.crt", // NetBSD
}

// Possible directories with certificate files; all will be read.
var certDirectories = []string{
	"/etc/ssl/certs",         // FreeBSD 12.2+