}
        ],
        "ips": [
            {
                "version": "4",
                "address": "10.0.0.2/24",
                "gateway": "10.0.0.1",
                "interface": 0
            }
        ],
        "routes": []

    },
    "log_level": "debug",
    "cni_event_address": "%s",
    "ambient_enabled": %t,
    "kubernetes": {
        "k8s_api_root": "APIRoot",

insecure                                 default
istioNamespace          istio-system     default
plaintext                                default
prefer-experimental                      default
xds-address                              default
xds-port                15012            default
`,
			WantException: false,
		},
	}

	for i, c := range cases {

	cniConfigStr := string(cniConfig)

	cniConfigStr = strings.ReplaceAll(cniConfigStr, "__LOG_LEVEL__", vars.logLevel)
	cniConfigStr = strings.ReplaceAll(cniConfigStr, "__LOG_UDS_ADDRESS__", vars.logUDSAddress)
	cniConfigStr = strings.ReplaceAll(cniConfigStr, "__CNI_EVENT_ADDRESS__", vars.cniEventAddress)
	cniConfigStr = strings.ReplaceAll(cniConfigStr, "__KUBECONFIG_FILENAME__", vars.kubeconfigFilename)

  // e.g. 'DiskPressure'
  // +optional
  optional string reason = 4;

  // IP address of the host to which the carp is assigned. Empty if not yet scheduled.
  // +optional
  optional string hostIP = 5;

  // IP address allocated to the carp. Routable at least within the cluster.
  // Empty if not yet allocated.
  // +optional
  optional string carpIP = 6;

	}

	resolvedAddr, err := net.ResolveUnixAddr("unixpacket", addr)
	if err != nil {
		return nil, fmt.Errorf("failed to resolve unix addr: %w", err)
	}
	// remove potentially existing address
	// Remove unix socket before use, if one is leftover from previous CNI restart
	if err := os.Remove(addr); err != nil && !os.IsNotExist(err) {
		// Anything other than "file not found" is an error.

		"-p", "tcp",
		"-m", "mark",
		"--mark", inpodTproxyMark,
		"-j", "ACCEPT",
	)

	// Do not redirect app calls to back itself via Ztunnel when using the endpoint address
	// e.g. appN => appN by lo
	iptablesBuilder.AppendVersionedRule("127.0.0.1/32", "::1/128",
		iptableslog.UndefinedCommand, ChainInpodOutput, iptablesconstants.NAT,
		"!", "-d", iptablesconstants.IPVersionSpecific,

			}
		}),
		ValidArgsFunction: completion.ValidPodsNameArgs(ctx),
	}

	common.attach(cmd)
	cmd.PersistentFlags().StringVar(&address, "address", "", "Filter workloads by address field")
	cmd.PersistentFlags().BoolVar(&verboseProxyConfig, "verbose", true, "Output more information")
	cmd.PersistentFlags().StringVar(&workloadsNamespace, "workload-namespace", "",

  // +optional
  optional QueuingConfiguration queuing = 2;
}

// LimitedPriorityLevelConfiguration specifies how to handle requests that are subject to limits.
// It addresses two issues:
//   - How are requests for this priority level limited?
//   - What should be done with requests that exceed the limit?
message LimitedPriorityLevelConfiguration {

  // +optional
  optional QueuingConfiguration queuing = 2;
}

// LimitedPriorityLevelConfiguration specifies how to handle requests that are subject to limits.
// It addresses two issues:
//   - How are requests for this priority level limited?
//   - What should be done with requests that exceed the limit?
message LimitedPriorityLevelConfiguration {

		ep := mustGetEndpoint(g, objs, "istiod-remote").Unstructured()
		g.Expect(ep).Should(HavePathValueEqual(PathValue{"subsets.[0].addresses.[0]", endpointSubsetAddressVal("", "169.10.112.88", "")}))
		g.Expect(ep).Should(HavePathValueContain(PathValue{"subsets.[0].ports.[0]", portVal("tcp-istiod", 15012, -1)}))

		checkClusterRoleBindingsReferenceRoles(g, objs)