//  4. Required, permitted, or forbidden key usages / extended key usages.
  //  5. Expiration/certificate lifetime: whether it is fixed by the signer, configurable by the admin.
  //  6. Whether or not requests for CA certificates are allowed.
  optional string signerName = 7;

  // expirationSeconds is the requested duration of validity of the issued

    # multicluster mesh, it will need to be migrated to the new mesh ID. Details
    # of migration TBD, and it may be a disruptive operation to change the Mesh
    # ID post-install.
    #
    # If the mesh admin does not specify a value, Istio will use the value of the
    # mesh's Trust Domain. The best practice is to select a proper Trust Domain
    # value.
    meshID: ""

podLabels:
  sidecar.istio.io/inject: "false"

# Demo only, so we will have no authentication
admin:
  existingSecret: ""
ldap:
  existingSecret: true
env:
  GF_SECURITY_ADMIN_USER: "admin"
  GF_SECURITY_ADMIN_PASSWORD: "admin"
  GF_AUTH_BASIC_ENABLED: "false"
  GF_AUTH_ANONYMOUS_ENABLED: "true"
  GF_AUTH_ANONYMOUS_ORG_ROLE: Admin

# Expose on port 3000 to match the Istio docs
service:
  port: 3000

package configdump

import (
	admin "github.com/envoyproxy/go-control-plane/envoy/admin/v3"
)

// GetEcdsConfigDump retrieves the extension config dump from the ConfigDump
func (w *Wrapper) GetEcdsConfigDump() (*admin.EcdsConfigDump, error) {
	ecdsDumpAny, err := w.getSections(ecds)
	if err != nil {
		return nil, err
	}

	ecdsDump := &admin.EcdsConfigDump{}
	for _, dump := range ecdsDumpAny {

package configdump

import (
	admin "github.com/envoyproxy/go-control-plane/envoy/admin/v3"
)

// GetEndpointsConfigDump retrieves the listener config dump from the ConfigDump
func (w *Wrapper) GetEndpointsConfigDump() (*admin.EndpointsConfigDump, error) {
	endpointsDumpAny, err := w.getSection(endpoints)
	if err != nil {
		return nil, nil
	}
	endpointsDump := &admin.EndpointsConfigDump{}

            # privileged is redundant with CAP_SYS_ADMIN
            # since it's redundant, hardcode it to `true`, then manually drop ALL + readd granular
            # capabilities we actually require
            capabilities:
              drop:
              - ALL
              add:
              # CAP_NET_ADMIN is required to allow ipset and route table access
              - NET_ADMIN

{
    "configs": [
        {
            "@type": "type.googleapis.com/envoy.admin.v3.EcdsConfigDump",
            "ecds_filters": [
                {
                    "version_info": "2022-12-08T09:07:09Z/10",
                    "ecds_filter": {
                        "@type": "type.googleapis.com/envoy.config.core.v3.TypedExtensionConfig",
                        "name": "default.httpbin-rate-limiting",
                        "typed_config": {

          privileged: false
          capabilities:
            drop:
            - ALL
            add: # See https://man7.org/linux/man-pages/man7/capabilities.7.html
            - NET_ADMIN # Required for TPROXY and setsockopt
            - SYS_ADMIN # Required for `setns` - doing things in other netns
            - NET_RAW # Required for RAW/PACKET sockets, TPROXY
          readOnlyRootFilesystem: true
          runAsGroup: 1337

// limitations under the License.

package cmd

import (
	"errors"
	"fmt"
	"path/filepath"
	"strings"

	"github.com/spf13/cobra"
	"github.com/spf13/viper"

	"istio.io/istio/istioctl/pkg/admin"
	"istio.io/istio/istioctl/pkg/analyze"
	"istio.io/istio/istioctl/pkg/authz"
	"istio.io/istio/istioctl/pkg/checkinject"
	"istio.io/istio/istioctl/pkg/cli"
	"istio.io/istio/istioctl/pkg/completion"

{
 "configs": [
  {
   "@type": "type.googleapis.com/envoy.admin.v3.RoutesConfigDump",
   "static_route_configs": [
    {
     "route_config": {
      "@type": "type.googleapis.com/envoy.config.route.v3.RouteConfiguration",
      "virtual_hosts": [
       {
        "name": "backend",
        "domains": [
         "*"
        ],
        "routes": [
         {
          "match": {
           "prefix": "/stats/prometheus"