The directory contains two Makefiles for generating new root, intermediate certificates and workload certificates:
- `Makefile.k8s.mk`: Creates certificates based on a root-ca from a k8s cluster. The current context in the default
`kubeconfig` is used for accessing the cluster.
- `Makefile.selfsigned.mk`: Creates certificates based on a generated self-signed root.

The table below describes the targets supported by both Makefiles.

_INTEGRATION_TEST_KUBECONFIG ?= $(INTEGRATION_TEST_KUBECONFIG)

# If $(INTEGRATION_TEST_KUBECONFIG) not specified, use $(KUBECONFIG).
ifeq ($(_INTEGRATION_TEST_KUBECONFIG),)
    _INTEGRATION_TEST_KUBECONFIG = $(KUBECONFIG)
endif

# If neither $(INTEGRATION_TEST_KUBECONFIG) nor $(KUBECONFIG) specified, use default.
ifeq ($(_INTEGRATION_TEST_KUBECONFIG),)
    _INTEGRATION_TEST_KUBECONFIG = ~/.kube/config
endif

area: istioctl

# issue is a list of GitHub issues resolved in this note.
issue:
  - https://github.com/istio/istio/issues/35574
releaseNotes:
- |

	or in the case of kubeconfig files, the PEM encoded signed certificate should be base64 encoded
	and added to the kubeconfig file in the "users > user > client-certificate-data" field.
`)
	generateCSRExample = cmdutil.Examples(`
	# The following command will generate keys and CSRs for all control-plane certificates and kubeconfig files:
	kubeadm certs generate-csr --kubeconfig-dir /tmp/etc-k8s --cert-dir /tmp/etc-k8s/pki
`)
)

//	  }
//	}
//
// The config file may be json or yaml.
//
// The kubeconfig property refers to another file in the kubeconfig format which
// specifies how to connect to the webhook backend.
//
// The kubeconfig's cluster field is used to refer to the remote service, user refers to the returned authorizer.
//
//	# clusters refers to the remote service.
//	clusters:

	// nolint: golint, revive, stylecheck
	GRPC_ECHO_IMAGE Variable = "GRPC_ECHO_IMAGE"

	// KUBECONFIG is the list of Kubernetes configuration files. If configuration files are specified on
	// the command-line, that takes precedence.
	// nolint: revive, stylecheck
	KUBECONFIG Variable = "KUBECONFIG"

	// IstioSrc is the location of istio source ($TOP/src/istio.io/istio

{
  "cniVersion": "0.3.1",
  "name": "istio-cni",
  "type": "istio-cni",
  "plugin_log_level": "__LOG_LEVEL__",
  "kubernetes": {
      "kubeconfig": "__KUBECONFIG_FILENAME__",
      "cni_bin_dir": "/path/cni/bin"
  }

			expectAuthenticator: false,
		},
		{
			name: "optional kubeconfig",
			options: func() *DelegatingAuthenticationOptions {
				opts := NewDelegatingAuthenticationOptions()
				opts.RemoteKubeConfigFileOptional = true
				return opts
			}(),
			expectError:          false, // in-cluster client building fails, no kubeconfig required
			expectAuthenticator:  true,

    - --logtostderr=false
    - --log_file=/var/log/glbc.log
    - --enable-finalizer-remove
    - --enable-finalizer-add
    - --default-backend-service=kube-system/default-http-backend
    - --kubeconfig=/etc/srv/kubernetes/l7-lb-controller/kubeconfig
    - --sync-period=600s
    - --running-in-cluster=false
    - --config-file-path=/etc/gce.conf
    - --healthz-port=8086
    - --gce-ratelimit=ga.Operations.Get,qps,10,100

apiVersion: release-notes/v2
kind: bug-fix
area: traffic-management
issue:
  - 48224
releaseNotes:
  - |