"istio.io/istio/pkg/config/labels"
	"istio.io/istio/pkg/kube"
)

type InstallArgs struct {
	// InFilenames is an array of paths to the input IstioOperator CR files.
	InFilenames []string
	// ReadinessTimeout is maximum time to wait for all Istio resources to be ready. wait must be true for this setting
	// to take effect.
	ReadinessTimeout time.Duration
	// SkipConfirmation determines whether the user is prompted for confirmation.

spec:
  ingressClassName: %s
  tls:
  - hosts: ["foo.example.com"]
    secretName: k8s-ingress-secret-foo
  - hosts: ["bar.example.com"]
    secretName: k8s-ingress-secret-bar
  rules:
  - http:
      paths:
      - backend:
          service:
            name: b
            port:
              name: http
        path: %s/namedport
        pathType: ImplementationSpecific
      - backend:
          service:

		// * Cluster.Server (and ProxyURL). This allows the user to send requests to arbitrary URLs, enabling potential SSRF attacks.
		//   However, we don't actually know what valid URLs are, so we cannot reasonably constrain this. Instead,
		//   we try to limit what confidential information could be exfiltrated (from AuthInfo). Additionally, the user cannot control
		//   the paths we send requests to, limiting potential attack scope.

		expected:   []message{
			// no messages, this test case verifies no false positives
		},
	},
	{
		name:       "externalControlPlaneValidWebhooks",
		inputFiles: []string{"testdata/externalcontrolplane-valid-urls-custom-ns.yaml"},
		analyzer:   &externalcontrolplane.ExternalControlPlaneAnalyzer{},
		expected:   []message{
			// no messages, this test case verifies no false positives
		},
	},
	{