// the command-line, that takes precedence.
	// nolint: revive, stylecheck
	KUBECONFIG Variable = "KUBECONFIG"

	// IstioSrc is the location of istio source ($TOP/src/istio.io/istio
	IstioSrc = REPO_ROOT.ValueOrDefaultFunc(getDefaultIstioSrc)

	// IstioOut is the location of the output directory ($TOP/out)
	IstioOut = verifyFile(TARGET_OUT, TARGET_OUT.ValueOrDefaultFunc(getDefaultIstioOut))

            val androidStudioPath = studioInstallation.studioInstallLocation.asFile.get().absolutePath
            return "-Dstudio.home=$androidStudioPath"
        } else if (androidStudioHome.isPresent) {
            return "-Dstudio.home=${androidStudioHome.get()}"
        }

#include "tensorflow/compiler/mlir/lite/flatbuffer_export.h"

#include <stddef.h>
#include <stdlib.h>

#include <algorithm>
#include <cassert>
#include <cstdint>
#include <cstdio>
#include <cstring>
#include <iterator>
#include <limits>
#include <map>
#include <memory>
#include <optional>
#include <set>
#include <string>
#include <unordered_map>
#include <unordered_set>

apiVersion: install.istio.io/v1alpha1
kind: IstioOperator
metadata:
  name: test
  namespace: istio-system
spec:
  meshConfig:
    # Set enableTracing to false to disable request tracing.
    enableTracing: true
    # This is the ingress service name, update if you used a different name
    ingressService: istio-ingress
    connectTimeout: 1s
    defaultConfig:
      ### ADVANCED SETTINGS #############

      # where the init container runs in a fresh environment and there cannot be previous Istio chains
      "${ISTIO_BIN_BASE}/pilot-agent" istio-clean-iptables

      # Update iptables, based on config file
      "${ISTIO_BIN_BASE}/pilot-agent" istio-iptables
    fi
fi

EXEC_USER=${EXEC_USER:-istio-proxy}
if [ "${ISTIO_INBOUND_INTERCEPTION_MODE}" = "TPROXY" ] ; then

# Istio Agent

This document describes the internal architecture of Istio agent.

## High Level overview

![High Level overview](docs/overview.svg)

At a high level, the Istio agent acts as an intermediate proxy between Istiod and Envoy. This is done
at two levels. For distributing workload certificates, Envoy will send [SDS](https://www.envoyproxy.io/docs/envoy/latest/configuration/security/secret)

{
  "cniVersion": "0.3.1",
  "name": "istio-cni",
  "type": "istio-cni",
  "ipam": {},
  "dns": {},
  "plugin_log_level": "debug",
  "log_uds_address": "",
  "cni_event_address": "/tmp/cnieventfoo",
  "ambient_enabled": false,
  "kubernetes": {
    "kubeconfig": "/etc/cni/net.d/ZZZ-istio-cni-kubeconfig",
    "exclude_namespaces": [
      "istio-system"
    ]
  }

          },
          "expr": "sum(container_memory_working_set_bytes{namespace!=\"istio-system\",container=\"istio-proxy\"}) / count(container_memory_working_set_bytes{namespace!=\"istio-system\",container=\"istio-proxy\"})",
          "format": "time_series",
          "intervalFactor": 1,
          "legendFormat": "per istio proxy",
          "refId": "B"
        }
      ],
      "title": "Memory Usage",

apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: direct-cnn-through-egress-gateway
spec:
  hosts:
  - fake.external.com
  gateways:
  - istio-egressgateway
  - mesh
  tls:
  - match:
    - gateways:
      - mesh
      port: 443
      sniHosts:
      - fake.external.com
    route:
    - destination:
        host: istio-egressgateway.istio-system.svc.cluster.local
        port:

apiVersion: install.istio.io/v1alpha1
kind: IstioOperator
metadata:
  namespace: istio-system
spec:
  profile: default
  meshConfig:
    trustDomain: example.org
  values:
    global:
    # This is used to customize the sidecar template
    sidecarInjectorWebhook:
      templates:
        spire: |
          spec:
            containers:
            - name: istio-proxy
              volumeMounts: