// Xds is XDS endpoint, e.g. localhost:15010.
	Xds string

	// XdsPodLabel is a Kubernetes label on the Istiod pods
	XdsPodLabel string

	// XdsPodPort is a port exposing XDS (typically 15010 or 15012)
	XdsPodPort int

	// CertDir is the local directory containing certificates
	CertDir string

	// Timeout is how long to wait before giving up on XDS
	Timeout time.Duration

  // with a pod's existing nodeSelector. Any conflicts will cause the pod to
  // be rejected in admission.
  // +optional
  // +mapType=atomic
  map<string, string> nodeSelector = 1;

  // tolerations are appended (excluding duplicates) to pods running with this
  // RuntimeClass during admission, effectively unioning the set of nodes
  // tolerated by the pod and the RuntimeClass.
  // +optional
  // +listType=atomic

  // with a pod's existing nodeSelector. Any conflicts will cause the pod to
  // be rejected in admission.
  // +optional
  // +mapType=atomic
  map<string, string> nodeSelector = 1;

  // tolerations are appended (excluding duplicates) to pods running with this
  // RuntimeClass during admission, effectively unioning the set of nodes
  // tolerated by the pod and the RuntimeClass.
  // +optional
  // +listType=atomic

    if [[ "${fn}" == *.go || "${fn}" == *.rs ]]; then
      newfile=$(cat "${WD}/copyright-banner-go.txt" "${fn}")
      echo "${newfile}" > "${fn}"
      echo "Fixing license: ${fn}"
    else
      echo "Cannot fix license: ${fn}. Unknown file type"
    fi
  fi

  # has no effect on outbound traffic: iptables REDIRECT is always used for
  # outbound connections.
  # If "REDIRECT", use iptables REDIRECT to NAT and redirect to Envoy.
  # The "REDIRECT" mode loses source addresses during redirection.
  # If "TPROXY", use iptables TPROXY to redirect to Envoy.
  # The "TPROXY" mode preserves both the source and destination IP
  # addresses and ports, so that they can be used for advanced filtering

      # labelPods will label all pods with <brokenPodLabelKey>=<brokenPodLabelValue>.
      # This is only capable of identifying broken pods; the user is responsible for fixing them (generally, by deleting them).
      # Note this gives the DaemonSet a relatively high privilege, as modifying pod metadata/status can have wider impacts.
      labelPods: false

Copyright (C) 2014-2019, Matt Butcher and Matt Farina

Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is

	}

	var outputBuffer bytes.Buffer
	comparator, err := NewComparator(&outputBuffer, map[string][]byte{"default": cfg}, cfg)
	if err != nil {
		t.Fatalf("Failed to create Comparator: %v", err)
	}
	err = comparator.Diff()
	if err != nil {
		t.Errorf("Unexpected error during diff: %v", err)
	}

	expected := []string{"Clusters Match", "Listeners Match", "Routes Match"}
	for _, exp := range expected {

or customize the ports to match the old defaults.
See the [security advisory](https://istio.io/latest/news/security/istio-security-2021-002/) for more information.

#### Other migrations

If you see errors like `rendered manifests contain a resource that already exists` during installation, you may need to forcibly take ownership.

          operator: Exists
        - effect: NoExecute
          operator: Exists
      priorityClassName: system-node-critical
      serviceAccountName: istio-cni
      # Minimize downtime during a rolling upgrade or deletion; tell Kubernetes to do a "force
      # deletion": https://kubernetes.io/docs/concepts/workloads/pods/pod/#termination-of-pods.
      terminationGracePeriodSeconds: 5
      containers: