// +optional
  optional bool seLinuxMount = 8;
}

// CSINode holds information about all CSI drivers installed on a node.
// CSI drivers do not need to create the CSINode object directly. As long as
// they use the node-driver-registrar sidecar container, the kubelet will
// automatically populate the CSINode object for the CSI driver as part of
// kubelet plugin registration.

  // name>-<resource name>, where <resource name> is the
  // PodResourceClaim.Name. Pod validation will reject the pod if the
  // concatenated name is not valid for a ResourceClaim (e.g. too long).
  //
  // An existing ResourceClaim with that name that is not owned by the
  // pod will not be used for the pod to avoid using an unrelated
  // resource by mistake. Scheduling and pod startup are then blocked

)

var configDumpFile string

func checkCmd(ctx cli.Context) *cobra.Command {
	cmd := &cobra.Command{
		Use:   "check [<type>/]<name>[.<namespace>]",
		Short: "Check AuthorizationPolicy applied in the pod.",
		Long: `Check prints the AuthorizationPolicy applied to a pod by directly checking
the Envoy configuration of the pod. The command is especially useful for inspecting

}

func profileDiffCmd(pfArgs *profileDiffArgs) *cobra.Command {
	return &cobra.Command{
		Use:   "diff <profile|file1.yaml> <profile|file2.yaml>",
		Short: "Diffs two Istio configuration profiles",
		Long:  "The diff subcommand displays the differences between two Istio configuration profiles.",
		Example: `  # Profile diff by providing yaml files
  istioctl profile diff manifests/profiles/default.yaml manifests/profiles/demo.yaml

  optional bool force = 2;

  // fieldManager is a name associated with the actor or entity
  // that is making these changes. The value must be less than or
  // 128 characters long, and only contain printable characters,
  // as defined by https://golang.org/pkg/unicode/#IsPrint. This
  // field is required.
  optional string fieldManager = 3;
}

)

func Cmd(ctx cli.Context) *cobra.Command {
	cmd := &cobra.Command{
		Use:   "metrics <workload name>...",
		Short: "Prints the metrics for the specified workload(s) when running in Kubernetes.",
		Long: `
Prints the metrics for the specified service(s) when running in Kubernetes.

This command finds a Prometheus pod running in the specified istio system
namespace. It then executes a series of queries per requested workload to

	var opts clioptions.ControlPlaneOptions
	cmd := &cobra.Command{
		Use:     "pod <pod>",
		Aliases: []string{"po"},
		Short:   "Describe pods and their Istio configuration [kube-only]",
		Long: `Analyzes pod, its Services, DestinationRules, and VirtualServices and reports
the configuration objects that affect that pod.`,
		Example: `  istioctl experimental describe pod productpage-v1-c7765c886-7zzd4`,

  // and notAfter fields in the issued certificate to determine the actual duration.
  //
  // The v1.22+ in-tree implementations of the well-known Kubernetes signers will
  // honor this field as long as the requested duration is not greater than the
  // maximum duration they will honor per the --cluster-signing-duration CLI
  // flag to the Kubernetes controller manager.
  //

    # the associated address in configSource, if nothing is specified
    # the default MCP is assumed.
    configSource:
      subscribedResources: []
    # The following is used to limit how long a sidecar can be connected
    # to a pilot. It balances out load across pilot instances at the cost of
    # increasing system churn.
    keepaliveMaxServerConnectionAge: 30m
    # Additional labels to apply to the deployment.

	defaultProxyAdminPort = 15000
)

func ZtunnelConfig(ctx cli.Context) *cobra.Command {
	configCmd := &cobra.Command{
		Use:   "ztunnel-config",
		Short: "Update or retrieve current Ztunnel configuration.",
		Long:  "A group of commands used to update or retrieve Ztunnel configuration from a Ztunnel instance.",
		Example: `  # Retrieve summary about workload configuration
  istioctl x ztunnel-config workload