ns := apps.Namespace
	labels := map[string]string{
		"request_protocol":               "tcp",
		"destination_service_name":       "istio-egressgateway",
		"destination_canonical_revision": "latest",
		"destination_canonical_service":  "istio-egressgateway",
		"destination_app":                "istio-egressgateway",
		// Does not play well with canonical revision which defaults to "latest".
		// "destination_version":            "unknown",

      PILOT_ENABLE_NODE_UNTAINT_CONTROLLERS: "true"
  ztunnel:
    terminationGracePeriodSeconds: 5
    env:
      SECRET_TTL: 5m

  gateways:
    istio-ingressgateway:
      enabled: false
    istio-egressgateway:
      enabled: false

`
		}, cert.CreateCASecretAlt)).
		Teardown(untaintNodes).
		Run()
}

func taintNodes(t resource.Context) error {
	nodeC := t.Clusters().Default().Kube().CoreV1().Nodes()

  istioctl proxy-status

  # Retrieve sync status for Envoys in a specific namespace
  istioctl proxy-status --namespace foo

  # Retrieve sync diff for a single Envoy and Istiod
  istioctl proxy-status istio-egressgateway-59585c5b9c-ndc59.istio-system

  # SECURITY OPTIONS

  # Retrieve proxy status information directly from the control plane, using token security

`,
		Example: `  # Retrieve sync status for all Envoys in a mesh
  istioctl x internal-debug syncz

  # Retrieve sync diff for a single Envoy and Istiod
  istioctl x internal-debug syncz istio-egressgateway-59585c5b9c-ndc59.istio-system

  # SECURITY OPTIONS

  # Retrieve syncz debug information directly from the control plane, using token security

	specialComponentPath = map[string]bool{
		"gateways":                      true,
		"gateways.istio-ingressgateway": true,
		"gateways.istio-egressgateway":  true,
	}

	skipTranslate = map[name.ComponentName]bool{
		name.IstioBaseComponentName:          true,
		name.IstioOperatorComponentName:      true,
		name.IstioOperatorCustomResourceName: true,

	}
	if !values.GetGateways().GetIstioEgressgateway().GetRunAsRoot().GetValue() {
		errs = util.AppendErrs(errs, validateGateways(spec.GetComponents().GetEgressGateways(), "istio-egressgateway"))
	}
	for _, raw := range values.GetGateways().GetIstioIngressgateway().GetIngressPorts() {
		p := raw.AsMap()
		var tp int
		if p["targetPort"] != nil {
			t, ok := p["targetPort"].(float64)
			if !ok {

		args.AppendSet("meshConfig.defaultConfig.proxyMetadata.ISTIO_DUAL_STACK", "true")
		args.AppendSet("values.gateways.istio-ingressgateway.ipFamilyPolicy", "RequireDualStack")
		args.AppendSet("values.gateways.istio-egressgateway.ipFamilyPolicy", "RequireDualStack")
	}

	// Include all user-specified values.
	for k, v := range cfg.Values {
		args.AppendSet("values."+k, v)
	}

	for k, v := range cfg.OperatorOptions {

  // Next available 31.
}

// Configuration for gateways.
message GatewaysConfig {
  // Configuration for an egress gateway.
  EgressGatewayConfig istio_egressgateway = 1 [json_name = "istio-egressgateway"];

  // Controls whether any gateways are enabled.
  google.protobuf.BoolValue enabled = 2;

  // Configuration for an ingress gateway.

	// Destination rules are defined here for global purposes. We do not want these
	// catch all destination rules to be the only dest rule, when processing CDS for
	// proxies like the istio-ingressgateway or istio-egressgateway.
	// If there are no service specific dest rules, we will end up picking up the same
	// rules anyway, later in the code

	// 1. select destination rule from proxy config namespace

	sizeCache     protoimpl.SizeCache
	unknownFields protoimpl.UnknownFields

	// Configuration for an egress gateway.
	IstioEgressgateway *EgressGatewayConfig `protobuf:"bytes,1,opt,name=istio_egressgateway,json=istio-egressgateway,proto3" json:"istio_egressgateway,omitempty"`
	// Controls whether any gateways are enabled.
	Enabled *wrapperspb.BoolValue `protobuf:"bytes,2,opt,name=enabled,proto3" json:"enabled,omitempty"`