message ClusterTrustBundle {
  // metadata contains the object metadata.
  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;

  // spec contains the signer (if any) and trust anchors.
  optional ClusterTrustBundleSpec spec = 2;
}

// ClusterTrustBundleList is a collection of ClusterTrustBundle objects
message ClusterTrustBundleList {
  // metadata contains the list metadata.
  //

  // on remote tasks will be considered stale and garbage collected after
  // `keep_alive_secs` of inactivity.
  virtual Status SetOrUpdateServerDef(const ServerDef& server_def,
                                      bool reset_context, int keep_alive_secs,
                                      int64_t init_timeout_in_ms, int retries,

  }

  private void testSubMultisetEntrySet(SubMultisetSpec spec) {
    List<Entry<E>> entries = copyToList(sortedMultiset.entrySet());
    for (int i = 0; i < entries.size(); i++) {
      List<Entry<E>> expected = spec.expectedEntries(i, entries);
      SortedMultiset<E> subMultiset = spec.subMultiset(sortedMultiset, entries, i);
      assertEquals(expected, copyToList(subMultiset.entrySet()));
    }

    istio.io/rev: {{ .Values.revision | default "default" | quote }}
    install.operator.istio.io/owning-resource: {{ .Values.ownerName | default "unknown" }}
    operator.istio.io/component: "IngressGateways"
spec:
{{- if not $gateway.autoscaleEnabled }}
{{- if $gateway.replicaCount }}
  replicas: {{ $gateway.replicaCount }}
{{- end }}
{{- end }}
  selector:
    matchLabels:
{{ $gateway.labels | toYaml | indent 6 }}

  // - spec.hostPID
  // - spec.hostIPC
  // - spec.hostUsers
  // - spec.securityContext.seLinuxOptions
  // - spec.securityContext.seccompProfile
  // - spec.securityContext.fsGroup
  // - spec.securityContext.fsGroupChangePolicy
  // - spec.securityContext.sysctls
  // - spec.shareProcessNamespace
  // - spec.securityContext.runAsUser

  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;

  // spec contains the specification of the Lease.
  // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
  // +optional
  optional LeaseSpec spec = 2;
}

// LeaseList is a list of Lease objects.
message LeaseList {
  // Standard list metadata.

			pod := buildFakeDryRunPod()
			pod.ObjectMeta.Annotations = tt.annotations
			pod.Spec.Containers[1].Env = tt.proxyEnv

			pod.Spec.Containers[1].SecurityContext = &corev1.SecurityContext{}

			if tt.customGID != nil {
				pod.Spec.Containers[1].SecurityContext.RunAsGroup = tt.customGID
			}

			if tt.customUID != nil {
				pod.Spec.Containers[1].SecurityContext.RunAsUser = tt.customUID
			}

  // Spec is the desired state of the Ingress.
  // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
  // +optional
  optional IngressSpec spec = 2;

  // Status is the current state of the Ingress.
  // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
  // +optional

	}
	if err := json.Unmarshal(uglyJSON, &decoded); err != nil {
		return []string{}, err
	}
	if d, ok := decoded.(map[string]any); ok {
		if v, ok := d["spec"]; ok {
			// Fall back to showing the entire spec.
			// (When --config-path is used there will be no spec to remove)
			decoded = v
		}
	}
	setflags, err := walk("", "", decoded)
	if err != nil {
		return []string{}, err
	}
	sort.Strings(setflags)

	"istio.io/istio/pkg/test/util/assert"
)

func TestGetPodIPIfPodIPPresent(t *testing.T) {
	pod := &corev1.Pod{
		ObjectMeta: metav1.ObjectMeta{
			Name:      "test",
			Namespace: "test",
		},
		Spec: corev1.PodSpec{
			NodeName: "derp",
		},
		Status: corev1.PodStatus{
			PodIP: "11.1.1.12",
		},
	}

	podIPs := GetPodIPsIfPresent(pod)
	assert.Equal(t, len(podIPs), 1)
}