// limitations under the License.

// This is a sample chained plugin that supports multiple CNI versions. It
// parses prevResult according to the cniVersion
package plugin

type iptables struct{}

func newIPTables() InterceptRuleMgr {
	return &iptables{}

    targetPort: 15017
    name: tcp-webhook
    protocol: TCP
  {{- if not (regexMatch "^([0-9]*\\.){3}[0-9]*$" .Values.global.remotePilotAddress) }}
  # if the remotePilotAddress is not an IP addr, we use ExternalName
  type: ExternalName
  externalName: {{ .Values.global.remotePilotAddress }}
  {{- end }}
{{- if .Values.global.ipFamilyPolicy }}
  ipFamilyPolicy: {{ .Values.global.ipFamilyPolicy }}
{{- end }}

    PILOT_ENABLE_SENDING_HBONE: "true"
    PILOT_ENABLE_SIDECAR_LISTENING_HBONE: "true"
    CA_TRUSTED_NODE_ACCOUNTS: "istio-system/ztunnel,kube-system/ztunnel"
platform: openshift
variant: distroless
seLinuxOptions:

	"istio.io/istio/istioctl/pkg/clioptions"
	"istio.io/istio/istioctl/pkg/multixds"
	"istio.io/istio/istioctl/pkg/xds"
	"istio.io/istio/pkg/kube"
	"istio.io/istio/pkg/test/util/assert"
)

type execTestCase struct {
	args     []string
	revision string
	noIstiod bool

	// Typically use one of the three
	expectedOutput string // Expected constant output

"name": { "type": "string" }, "port": { "type": "integer" }, "protocol": { "type": "string" }, "targetPort": { "type": "integer" } } } }, "type": { "type": "string" } } }, "serviceAccount": { "type": "object", "properties": { "annotations": { "type": "object" }, "name": { "type": "string" }, "create": { "type": "boolean" } } }, "rbac": { "type": "object", "properties": { "enabled": { "type": "boolean" } } }, "tolerations": { "type": "array" }, "topologySpreadConstr": { "type": "array" }, "networkGateway":...

{
    "ecdsFilters": [
        {
            "versionInfo": "2022-12-08T09:07:09Z/10",
            "ecdsFilter": {
                "@type": "type.googleapis.com/envoy.config.core.v3.TypedExtensionConfig",
                "name": "default.httpbin-rate-limiting",
                "typedConfig": {
                    "@type": "type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm",
                    "config": {

      "panels": [],
      "targets": [
        {
          "datasource": {
            "type": "prometheus",
            "uid": "${datasource}"
          },
          "refId": "A"
        }
      ],
      "title": "vCPU Usage",
      "type": "row"
    },
    {
      "datasource": {
        "type": "prometheus",
        "uid": "${datasource}"
      },
      "fieldConfig": {
        "defaults": {

	}
	mt, err := protoregistry.GlobalTypes.FindMessageByName(protoreflect.FullName(mname))
	if err != nil {
		// istioctl should keep going if it encounters new Envoy versions; ignore unknown types
		return &exprpb.Type{TypeKind: &exprpb.Type_Dyn{Dyn: &emptypb.Empty{}}}, nil
	}
	return legacyproto.MessageV1(mt.New().Interface()), nil

// limitations under the License.

package ipset

import (
	"errors"
	"net/netip"
)

func RealNlDeps() NetlinkIpsetDeps {
	return &realDeps{}
}

type realDeps struct{}

func (m *realDeps) ipsetIPHashCreate(name string, v6 bool) error {
	return errors.New("not implemented on this platform")
}

func (m *realDeps) destroySet(name string) error {

)

var ErrPodNotFound = errors.New("netns not provided, but is needed as pod is not in cache")

type PodNetnsCache interface {
	ReadCurrentPodSnapshot() map[string]WorkloadInfo
}

// Hold a cache of node local pods with their netns
// if we don't know the netns, the pod will still be here with a nil netns.
type podNetnsCache struct {
	openNetns func(nspath string) (NetnsCloser, error)

	currentPodCache map[string]WorkloadInfo