|PROV_CERT|certificates to be used for mTLS communication with control plane only; NOT for workload mTLS|
|OUTPUT_CERT|write all fetched certificates to some directory. Used to support applications that need certificates (Prometheus) as well as rotating mTLS control plane authentication.|
|FILE_MOUNTED_CERTS|completely disable CA path, exclusively use certs mounted into the pod with set certificate file locations|

`Generators` get as input the `Proxy` (a representation of the current client), the current `PushContext` snapshot, and a list of config updates that caused the change.

	w := NewStyleWriter(got)
	w.AddHeader("NAME", "NAMESPACE", "VERSION")
	w.SetAddRowFunc(func(obj interface{}) Row {
		o := obj.(testObject)
		return Row{
			Cells: []Cell{
				NewCell(o.name),
				NewCell(o.namespace, color.FgGreen),
				NewCell(o.version),
			},
		}
	})
	w.AddRow(newTestObject("foo", "bar", "1.0"))
	w.AddRow(newTestObject("baz", "qux", "2.0"))
	w.AddRow(newTestObject("qux", "quux", "3"))
	w.Flush()

      --log_target: The set of paths where to output the log. This can be any path as well as the special values stdout and stderr
`

func TestLogHelp(t *testing.T) {
	var out bytes.Buffer
	rootCmd := GetRootCmd([]string{"options"})
	rootCmd.SetOut(&out)
	rootCmd.SetErr(&out)

```

**`kube.Client`** is a fairly light wrapper around Kubernetes clients, but offers quite a few benefits.
Istio consumes _many_ different types of clients (at the time of writing, 7), as well as informers for each of these.
Additionally, we often need to convert to various different client forms for different libraries we integrate with.

  optional string warning = 3;
}

message MatchCondition {
  // Name is an identifier for this match condition, used for strategic merging of MatchConditions,
  // as well as providing an identifier for logging purposes. A good name should be descriptive of
  // the associated expression.
  // Name must be a qualified name consisting of alphanumeric characters, '-', '_' or '.', and

contains platform-specific code to populate the
[abstract service model](https://istio.io/docs/concepts/traffic-management/#pilot), dynamically reconfigure the proxies
when the application topology changes, as well as translate
[routing rules](https://istio.io/latest/docs/reference/config/networking/) into proxy specific configuration.

# This manifest installs the Istio install-cni container, as well
# as the Istio CNI plugin and config on
# each master and worker node in a Kubernetes cluster.
{{- $defaultBinDir :=
    (.Capabilities.KubeVersion.GitVersion | contains "-gke") | ternary
      "/home/kubernetes/bin"
      "/opt/cni/bin"
}}
kind: DaemonSet
apiVersion: apps/v1
metadata:
  name: istio-cni-node
  namespace: {{ .Release.Namespace }}
  labels:

message GroupSubject {
  // name is the user group that matches, or "*" to match all user groups.
  // See https://github.com/kubernetes/apiserver/blob/master/pkg/authentication/user/user.go for some
  // well-known group names.
  // Required.
  optional string name = 1;
}

// LimitResponse defines how to handle requests that can not be executed right now.
// +union
message LimitResponse {

		if cfg.InstallConfig.AmbientEnabled {
			// Start ambient controller

			// node agent will spawn a goroutine and watch the K8S API for events,
			// as well as listen for messages from the CNI binary.
			log.Info("Starting ambient node agent with inpod redirect mode")
			ambientAgent, err := nodeagent.NewServer(ctx, watchServerReady, cfg.InstallConfig.CNIEventAddress,