"--etcd-keyfile=/var/run/kubernetes/etcd.key",
		"--etcd-certfile=/var/run/kubernetes/etcdce.crt",
		"--etcd-cafile=/var/run/kubernetes/etcdca.crt",
		"--http2-max-streams-per-connection=42",
		"--tracing-config-file=/var/run/kubernetes/tracing_config.yaml",
		"--proxy-client-cert-file=/var/run/kubernetes/proxy.crt",
		"--proxy-client-key-file=/var/run/kubernetes/proxy.key",
		"--request-timeout=2m",

      }
      while (bb.remaining() >= 16) {
        crc0 = computeForWord(crc0);
        crc1 = computeForWord(crc1);
        crc2 = computeForWord(crc2);
        crc3 = computeForWord(crc3);
        crc0 ^= bb.getInt();
        crc1 ^= bb.getInt();
        crc2 ^= bb.getInt();
        crc3 ^= bb.getInt();
      }
    }

    @Override
    protected void processRemaining(ByteBuffer bb) {

        -subj "/C=US/ST=Denial/L=Ether/O=Dis/CN=localhost/SAN=localhost" \
        -addext "subjectAltName = DNS:localhost"

openssl req -new -newkey rsa:4096 -x509 -sha256 \
        -days 3650 -nodes -out cert2.pem -keyout key2.pem \
        -subj "/C=US/ST=Denial/L=Ether/O=Dis/CN=anotherhost" \

			Data: map[string]string{
				"ca.crt": string(c.rootCA),
			},
		}, metav1.CreateOptions{})
		// don't retry a create if the namespace doesn't exist or is terminating
		if apierrors.IsNotFound(err) || apierrors.HasStatusCause(err, v1.NamespaceTerminatingCause) {
			return nil
		}
		return err
	case err != nil:
		return err
	}

	data := map[string]string{
		"ca.crt": string(c.rootCA),
	}

          - --xds-grpc-server=7070
          - --port=8080
          - --port=3333
          - --grpc=17171
          - --bind-localhost=17171
          - --version=bar
          - --istio-version=
          - --crt=/cert.crt
          - --key=/cert.key
        ports:
        - containerPort: 7070
        - containerPort: 8080
        - containerPort: 3333
          name: tcp-health-port
        - containerPort: 17171
        env:

					ServerCertificate: "server-cert.crt",
					PrivateKey:        "private-key.key",
					CaCertificates:    "ca-cert.crt",
				},
			},
			result: &auth.DownstreamTlsContext{
				CommonTlsContext: &auth.CommonTlsContext{
					AlpnProtocols: util.ALPNHttp,
					TlsCertificateSdsSecretConfigs: []*auth.SdsSecretConfig{
						{
							Name: "file-cert:server-cert.crt~private-key.key",

	rootCmd.PersistentFlags().StringVar(&version, "version", "", "Version string")
	rootCmd.PersistentFlags().StringVar(&cluster, "cluster", "", "Cluster where this server is deployed")
	rootCmd.PersistentFlags().StringVar(&crt, "crt", "", "gRPC TLS server-side certificate")
	rootCmd.PersistentFlags().StringVar(&key, "key", "", "gRPC TLS server-side key")
	rootCmd.PersistentFlags().StringVar(&istioVersion, "istio-version", "", "Istio sidecar version")

	if cfg == nil {
		return
	}
	script := path.Join(env.IstioSrc, "samples/jwt-server/testdata", "ca.crt")
	rootCaCert, err := cert.LoadCert(script)
	if err != nil {
		return
	}
	// command to generate certificate
	// use the generated ca.crt by following https://github.com/istio/istio/blob/master/samples/jwt-server/testdata/README.MD

{{- range $i := until .Services }}
apiVersion: v1
kind: Secret
metadata:
  name: sds-credential-{{$i}}
  namespace: default
type: kubernetes.io/tls
data:

	CRC32B (SI), AX

done:
	MOVL AX, ret+32(FP)
	RET

// castagnoliSSE42Triple updates three (non-inverted) crcs with (24*rounds)
// bytes from each buffer.
//
// func castagnoliSSE42Triple(
//     crc1, crc2, crc3 uint32,
//     a, b, c []byte,
//     rounds uint32,
// ) (retA uint32, retB uint32, retC uint32)
TEXT ·castagnoliSSE42Triple(SB),NOSPLIT,$0
	MOVL crcA+0(FP), AX
	MOVL crcB+4(FP), CX
	MOVL crcC+8(FP), DX