mountPath: /var/lib/istio/inject
{{- end }}
`, map[string]any{
		"rootcert1":              cert1.Rootcert,
		"signer1":                cert1.Signer,
		"rootcert2":              cert2.Rootcert,
		"signer2":                cert2.Signer,
		"isConfigCluster":        isConfigCluster,
		"isExternalControlPlane": isExternalControlPlane,
	})
	return cfgYaml

FROM ${ISTIO_BASE_REGISTRY}/base:${BASE_VERSION}

ARG TARGETARCH
COPY ${TARGETARCH:-amd64}/client /usr/local/bin/client
COPY ${TARGETARCH:-amd64}/server /usr/local/bin/server
COPY certs/cert.crt /cert.crt
COPY certs/cert.key /cert.key

# Add a user that will run the application. This allows running as this user and capture iptables
RUN useradd -m --uid 1338 application
USER 1338

	// w[i] = p[j]<<24 | p[j+1]<<16 | p[j+2]<<8 | p[j+3]
	// e += w[i]
#define LOAD(Re) \
	MOVBU	2(Rdata), Rt0 ; \
	MOVBU	3(Rdata), Rt1 ; \
	MOVBU	1(Rdata), Rt2 ; \
	ORR	Rt0<<8, Rt1, Rt0	    ; \
	MOVBU.P	4(Rdata), Rt1 ; \
	ORR	Rt2<<16, Rt0, Rt0	    ; \
	ORR	Rt1<<24, Rt0, Rt0	    ; \
	MOVW.P	Rt0, 4(Rw)		    ; \
	ADD	Rt0, Re, Re

	// tmp := w[(i-3)&0xf] ^ w[(i-8)&0xf] ^ w[(i-14)&0xf] ^ w[(i)&0xf]

var certFiles = []string{
	"/usr/local/etc/ssl/cert.pem",            // FreeBSD
	"/etc/ssl/cert.pem",                      // OpenBSD
	"/usr/local/share/certs/ca-root-nss.crt", // DragonFly
	"/etc/openssl/certs/ca-certificates.crt", // NetBSD
}

// Possible directories with certificate files; all will be read.
var certDirectories = []string{
	"/etc/ssl/certs",         // FreeBSD 12.2+

		"--etcd-certfile=/var/run/kubernetes/etcdce.crt",
		"--etcd-cafile=/var/run/kubernetes/etcdca.crt",
		"--http2-max-streams-per-connection=42",
		"--kubelet-read-only-port=10255",
		"--kubelet-timeout=5s",
		"--kubelet-client-certificate=/var/run/kubernetes/ceserver.crt",
		"--kubelet-client-key=/var/run/kubernetes/server.key",
		"--kubelet-certificate-authority=/var/run/kubernetes/caserver.crt",

// license that can be found in the LICENSE file.

//go:build freebsd

package cgo

import _ "unsafe" // for go:linkname

// Supply environ and __progname, because we don't
// link against the standard FreeBSD crt0.o and the
// libc dynamic library needs them.

//go:linkname _environ environ
//go:linkname _progname __progname

//go:cgo_export_dynamic environ
//go:cgo_export_dynamic __progname

var _environ uintptr

// license that can be found in the LICENSE file.

//go:build netbsd

package cgo

import _ "unsafe" // for go:linkname

// Supply environ and __progname, because we don't
// link against the standard NetBSD crt0.o and the
// libc dynamic library needs them.

//go:linkname _environ environ
//go:linkname _progname __progname
//go:linkname ___ps_strings __ps_strings

var _environ uintptr
var _progname uintptr

          - "17070"
          - --grpc
          - "17171"
          - --port
          - "3333"
          - --port
          - "8080"
          - --version
          - v1
          - --crt=/cert.crt
          - --key=/cert.key
          env:
          - name: INSTANCE_IP
            valueFrom:
              fieldRef:
                apiVersion: v1
                fieldPath: status.podIP

        assertArtifacts("d", ["mymodule", "art2"])

        and:
        artifacts("a")*.artifactName*.name == ['mymodule', 'art2', 'art3']
        artifacts("a")*.artifactName*.type == ['jar', 'type', 'type2']
        artifacts("a")*.artifactName*.extension == ['jar', 'ext', 'type2']

        and:
        artifacts("b")*.artifactName*.name == ['mymodule', 'art2', 'art3']

      }
      while (bb.remaining() >= 16) {
        crc0 = computeForWord(crc0);
        crc1 = computeForWord(crc1);
        crc2 = computeForWord(crc2);
        crc3 = computeForWord(crc3);
        crc0 ^= bb.getInt();
        crc1 ^= bb.getInt();
        crc2 ^= bb.getInt();
        crc3 ^= bb.getInt();
      }
    }

    @Override
    protected void processRemaining(ByteBuffer bb) {