},
    {
      "sysctl": {
        "net.core.somaxconn": "500"
      },
      "type": "tuning"
    },
    {
      "kubernetes": {
        "cni_bin_dir": "/path/cni/bin",
        "kubeconfig": "/path/to/kubeconfig"
      },
      "name": "istio-cni",
      "plugin_log_level": "debug",
      "type": "istio-cni"
    }
  ]

		optionalKubeConfigSentence = " This is optional. If empty, all requests not skipped by authorization are forbidden."
	}
	fs.StringVar(&s.RemoteKubeConfigFile, "authorization-kubeconfig", s.RemoteKubeConfigFile,
		"kubeconfig file pointing at the 'core' kubernetes server with enough rights to create "+
			"subjectaccessreviews.authorization.k8s.io."+optionalKubeConfigSentence)

		}
	})
	return expander, nil
}

// AddFlags binds client configuration flags to a given flagset
func (f *ConfigFlags) AddFlags(flags *pflag.FlagSet) {
	if f.KubeConfig != nil {
		flags.StringVar(f.KubeConfig, "kubeconfig", *f.KubeConfig, "Path to the kubeconfig file to use for CLI requests.")
	}
	if f.CacheDir != nil {
		flags.StringVar(f.CacheDir, flagCacheDir, *f.CacheDir, "Default cache directory")
	}

    {
      "ambient_enabled": false,
      "cni_event_address": "",
      "dns": {},
      "ipam": {},
      "kubernetes": {
        "exclude_namespaces": [
          ""
        ],
        "kubeconfig": "/path/to/kubeconfig"
      },
      "log_uds_address": "",
      "name": "istio-cni",
      "plugin_log_level": "debug",
      "type": "istio-cni"
    }
  ]

      value: {{kubectl_prune_whitelist_override}}
    - name: KUBECTL_EXTRA_PRUNE_WHITELIST
      value: {{kubectl_extra_prune_whitelist}}
    - name: KUBECTL_OPTS
      value: '--kubeconfig=/etc/srv/kubernetes/addon-manager/kubeconfig'
  volumes:
  - hostPath:
      path: /etc/kubernetes/
    name: addons
  - hostPath:
      path: /var/log
    name: varlog
  - hostPath:
      path: /etc/srv/kubernetes/addon-manager/

    echo "Fetching kubelet bootstrap-kubeconfig file from metadata"
    get-metadata-value "instance/attributes/bootstrap-kubeconfig" >/var/lib/kubelet/bootstrap-kubeconfig
  else
    echo "Fetching kubelet kubeconfig file from metadata"
    get-metadata-value "instance/attributes/kubeconfig" >/var/lib/kubelet/kubeconfig
  fi
}

				}
				return
			}
			if err != nil {
				t.Fatal(err)
			}
			if kubeconfig != tc.expectKubeconfig {
				t.Fatalf("expected %q, got %q", tc.expectKubeconfig, kubeconfig)
			}
		})
	}

              path: istio-token
      - name: cacerts
        secret:
          optional: true
          secretName: cacerts
      - name: istio-kubeconfig
        secret:
          optional: true
          secretName: istio-kubeconfig
      - name: istio-csr-dns-cert
        secret:
          optional: true
          secretName: istiod-tls
      - configMap:
          defaultMode: 420

			// Create expected kubeconfigs
			for _, kubeConfig := range test.kubeConfigShouldExist {
				if err := kubeconfigphase.CreateKubeConfigFile(kubeConfig, tmpDir, cfg); err != nil {
					t.Fatalf("couldn't create kubeconfig %q: %v", kubeConfig, err)
				}

				newCerts, err := getEmbeddedCerts(tmpDir, kubeConfig)
				if err != nil {
					t.Fatalf("error reading embedded certs from %s: %v", kubeConfig, err)
				}

	klog.V(1).Infoln("[bootstrap-token] loading admin kubeconfig")
	adminConfig, err := clientcmd.LoadFromFile(file)
	if err != nil {
		return errors.Wrap(err, "failed to load admin kubeconfig")
	}
	if err = clientcmdapi.FlattenConfig(adminConfig); err != nil {
		return err
	}