apiVersion: extensions.istio.io/v1alpha1
kind: WasmPlugin
metadata:
  name: valid
spec:
  selector:
    matchLabels:
      istio: ingressgateway
  url: oci://private-registry:5000/openid-connect/openid:latest
  imagePullPolicy: IfNotPresent
  imagePullSecret: private-registry-pull-secret
  phase: AUTHN
  pluginConfig:
    openid_server: authn

# See https://kind.sigs.k8s.io/docs/user/quick-start/#loading-an-image-into-your-cluster
export PULL_POLICY=IfNotPresent

# We run a local-registry in a docker container that KinD nodes pull from
# These values are must match what is in config/trustworthy-jwt.yaml
export KIND_REGISTRY_NAME="kind-registry"
export KIND_REGISTRY_PORT="5000"
export KIND_REGISTRY="localhost:${KIND_REGISTRY_PORT}"

export HUB=${HUB:-"istio-testing"}

        "service-account-signing-key-file": "/etc/kubernetes/pki/sa.key"
containerdConfigPatches:
  - |-
    [plugins."io.containerd.grpc.v1.cri".registry.mirrors."localhost:5000"]

					"random-1.host.example": {
						Ips:      []string{"240.240.116.21"},
						Registry: "External",
					},
					"random-2.host.example": {
						Ips:      []string{"9.9.9.9"},
						Registry: "External",
					},
					"random-3.host.example": {
						Ips:      []string{"240.240.81.100"},
						Registry: "External",
					},
				},
			},
		},
		{
			name: "just capture",

apiVersion: release-notes/v2
kind: bug-fix
area: traffic-management
issue:
  - 50968
releaseNotes:
  - |

  esac
done

# This block is to setup kind to have a local image repo to push
# images using localhost:5000, to use this feature, start up
# a registry container such as gcr.io/istio-testing/registry, then
# connect it to the docker network where kind nodes are running on
# which normally will be called kind
FEATURES=$(cat << EOF
featureGates:
  MixedProtocolLBService: true

h="${BOOKINFO_HUB:?BOOKINFO_HUB must be set}"
t="${BOOKINFO_TAG:?BOOKINFO_TAG must be set}"
if [[ ("${h}" == "istio" || "${h}" == "docker.io/istio") && -z "$CI" && "$*" =~ "--push" ]]; then
  echo "Can only push to prod registry in CI"
  exit 1
fi

if [[ "${BOOKINFO_LATEST}" == "true" ]]; then
  BOOKINFO_TAG="${BOOKINFO_TAG},latest"
fi

# Pass input args to the command. This allows using --push, --load, etc

// sha256-simd (https://github.com/google/go-containerregistry/issues/1330) makes this even faster -
// pushing all images drops to sub-second times, with the registry being the bottleneck (which could
// also use sha256-simd possibly).
func RunCrane(ctx context.Context, a Args) error {
	ctx, span := tracing.Start(ctx, "RunCrane")
	defer span.End()
	g := errgroup.Group{}

	TagFlagHelpStr                     = `The tag for the operator controller image.`
	ImagePullSecretsHelpStr            = `The imagePullSecrets are used to pull the operator image from the private registry,
could be secret list separated by comma, eg. '--imagePullSecrets imagePullSecret1,imagePullSecret2'`
	OperatorNamespaceHelpstr  = `The namespace the operator controller is installed into.`

	GCEMetadataServerInstallFilePath = path.Join(IstioSrc, getInstallationFile("gcemetadata/gce_metadata_server.yaml"))

	// RegistryRedirectorServerInstallFilePath is the registry redirector installation file.
	RegistryRedirectorServerInstallFilePath = path.Join(IstioSrc, getInstallationFile("registryredirector/registry_redirector_server.yaml"))
)

var (
	_, b, _, _ = runtime.Caller(0)