JwtRule      = env.Register("JWT_RULE", "",
		"The JWT rule used by istiod authentication").Get()
)

// Revision is the value of the Istio control plane revision, e.g. "canary",
// and is the value used by the "istio.io/rev" label.
var Revision = env.Register("REVISION", "", "").Get()

// NewPilotArgs constructs pilotArgs with default values.
func NewPilotArgs(initFuncs ...func(*PilotArgs)) *PilotArgs {

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: {{ template "name" . }}
  labels:
    app: {{ template "name" . }}
    release: {{ .Release.Name }}
    istio.io/rev: {{ .Values.revision | default "default" }}
    install.operator.istio.io/owning-resource: {{ .Values.ownerName | default "unknown" }}
    operator.istio.io/component: "Cni"
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: {{ template "name" . }}
  labels:
    app: {{ template "name" . }}
    release: {{ .Release.Name }}
    istio.io/rev: {{ .Values.revision | default "default" }}
    install.operator.istio.io/owning-resource: {{ .Values.ownerName | default "unknown" }}
    operator.istio.io/component: "Cni"
rules:
- apiGroups: [""]
  resources: ["pods","nodes","namespaces"]

  {{- if .Values.global.imagePullSecrets }}
imagePullSecrets:
  {{- range .Values.global.imagePullSecrets }}
  - name: {{ . }}
  {{- end }}
  {{- end }}
metadata:
  name: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
  namespace: {{ .Values.global.istioNamespace }}
  labels:
    app: istiod
    release: {{ .Release.Name }}
  {{- if .Values.pilot.serviceAccountAnnotations }}
  annotations:

  {{- if .Values.global.imagePullSecrets }}
imagePullSecrets:
  {{- range .Values.global.imagePullSecrets }}
  - name: {{ . }}
  {{- end }}
  {{- end }}
metadata:
  name: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}
  namespace: {{ .Values.global.istioNamespace }}
  labels:
    app: istiod
    release: {{ .Release.Name }}
  {{- if .Values.pilot.serviceAccountAnnotations }}
  annotations:

	PodName           = env.RegisterStringVar("POD_NAME", "", "").Get()
	NodeName          = env.RegisterStringVar("NODE_NAME", "", "").Get()
	Revision          = env.RegisterStringVar("REVISION", "", "").Get()
	HostProbeSNATIP   = netip.MustParseAddr(env.RegisterStringVar("HOST_PROBE_SNAT_IP", DefaultHostProbeSNATIP, "").Get())

  # Default K8S value is 30 seconds
  terminationGracePeriodSeconds: 30

  # Revision is set as 'version' label and part of the resource names when installing multiple control planes.
  # Used to locate the XDS and CA, if caAddress or xdsAddress are not set explicitly.
  revision: ""

  # The customized CA address to retrieve certificates for the pods in the cluster.

        {{- else }}
          value: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}.{{ .Values.istioNamespace }}.svc:15012
        {{- end }}
        - name: XDS_ADDRESS
        {{- if .Values.xdsAddress }}
          value: {{ .Values.xdsAddress }}
        {{- else }}
          value: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}.{{ .Values.istioNamespace }}.svc:15012
        {{- end }}

			istioCtl := istioctl.NewOrFail(ctx, ctx, istioctl.Config{})
			testCases := []installTestCase{
				{
					command:   []string{"install", "--dry-run", "--revision", ""},
					errString: InvalidRevision,
				},
				{
					command:   []string{"install", "--dry-run", "--revision", "1.8.0"},
					errString: InvalidRevision,
				},
				{
					command:   []string{"install", "--dry-run", "--set", "values.global.network=network1"},

func (s *Server) initKubeRegistry(args *PilotArgs) (err error) {
	args.RegistryOptions.KubeOptions.ClusterID = s.clusterID
	args.RegistryOptions.KubeOptions.Revision = args.Revision
	args.RegistryOptions.KubeOptions.Metrics = s.environment
	args.RegistryOptions.KubeOptions.XDSUpdater = s.XDSServer
	args.RegistryOptions.KubeOptions.MeshNetworksWatcher = s.environment.NetworksWatcher