```yaml
apiVersion: install.istio.io/v1alpha1
kind: IstioOperator
spec:
  components:
    pilot:
      k8s:
        overlays:
        - kind: Deployment
          name: istio-pilot
          patches:
          - path: spec.template.spec.containers.[name:discovery].args.[30m]
            value: "60m" # OVERRIDDEN
          - path: spec.template.spec.containers.[name:discovery].ports.[containerPort:8080].containerPort

}

var interceptorFunc = interceptor.Funcs{Patch: func(
	ctx context.Context,
	clnt client.WithWatch,
	obj client.Object,
	patch client.Patch,
	opts ...client.PatchOption,
) error {
	// Apply patches are supposed to upsert, but fake client fails if the object doesn't exist,
	// if an apply patch occurs for an object that doesn't yet exist, create it.
	if patch.Type() != types.ApplyPatchType {

		if len(filename) == 0 {
			filename = "YYY-istio-cni.conf"
		}
		return filepath.Join(cfg.mountedCNINetDir, filename), nil
	}

	watcher, err := util.CreateFileWatcher(cfg.mountedCNINetDir)
	if err != nil {
		return "", err
	}
	defer watcher.Close()

	for len(filename) == 0 {
		filename, err = getDefaultCNINetwork(cfg.mountedCNINetDir)
		if err == nil {
			break
		}

  // MatchConditions is a list of conditions that must be met for a request to be sent to this
  // webhook. Match conditions filter requests that have already been matched by the rules,
  // namespaceSelector, and objectSelector. An empty list of matchConditions matches all requests.
  // There are a maximum of 64 match conditions allowed.
  //
  // The exact matching logic is (in order):

    echo "${original_coredns}"
    # Patch it
    fixed_coredns=$(
      printf '%s' "${original_coredns}" | sed \
        -e 's/^.*kubernetes cluster\.local/& internal/' \
        -e '/^.*upstream$/d' \
        -e '/^.*fallthrough.*$/d' \
        -e '/^.*forward . \/etc\/resolv.conf$/d' \
        -e '/^.*loop$/d' \
    )
    echo "Patched CoreDNS config:"
    echo "${fixed_coredns}"

               "name": "default",
               "domains": [
                "*"
               ],
               "routes": [
                {
                 "match": {
                  "connect_matcher": {}
                 },
                 "route": {
                  "cluster": "main_internal",
                  "upgrade_configs": [
                   {
                    "upgrade_type": "CONNECT",

            properties:
              configPatches:
                description: One or more patches with match conditions.
                items:
                  properties:
                    applyTo:
                      description: |-
                        Specifies where in the Envoy configuration, the patch should be applied.

string value: description: The JSON config of the object being patched. type: object x-kubernetes-preserve-unknown-fields: true type: object type: object type: array priority: description: Priority defines the order in which patch sets are applied within a context. format: int32 type: integer workloadSelector: description: Criteria used to select the specific set of pods/VMs on which this patch configuration should be applied. properties: labels: additionalProperties: type: string description: One or more...

  // +optional
  optional string message = 4;
}

// An empty preferred scheduling term matches all objects with implicit weight 0
// (i.e. it's a no-op). A null preferred scheduling term matches no objects (i.e. is also a no-op).
message PreferredSchedulingTerm {
  // Weight associated with matching the corresponding nodeSelectorTerm, in the range 1-100.

                  },
                  "custom_match": {
                    "name": "ip",
                    "typed_config": {
                      "@type": "type.googleapis.com/xds.type.matcher.v3.IPMatcher",
                      "range_matchers": [
                        {
                          "ranges": [
                            {
                              "address_prefix": "10.111.182.109",