ports:
        - containerPort: 15090
          protocol: TCP
          name: http-envoy-prom
        args:
        - proxy
        - sidecar
        - --domain
        - $(POD_NAMESPACE).svc.{{ .Values.global.proxy.clusterDomain }}
        - --proxyLogLevel={{ annotation .ObjectMeta `sidecar.istio.io/logLevel` .Values.global.proxy.logLevel }}

							for _, svc := range apps.Ns1.All {
								if svc.Config().Service != to.Config().Service {
									cases = append(cases,
										testCase{
											path:  fmt.Sprintf("/policy-%s-%s", svc.Config().Namespace.Prefix(), svc.Config().Service),
											allow: false,
										},
										testCase{
											path:  fmt.Sprintf("/policy-system-%s", svc.Config().Service),
											allow: false,

	go func() { controller.Run(tCtx, 1) }()

	svc := &v1.Service{
		ObjectMeta: metav1.ObjectMeta{Name: "foo", Namespace: ns},
		Spec: v1.ServiceSpec{
			Selector:  map[string]string{"foo": "bar"},
			ClusterIP: "None",
			Ports:     nil,
		},
	}

	controller.serviceStore.Add(svc)
	controller.onServiceUpdate(svc)

		{
			name: "url is not https",
			in:   "http://oidc.oidc-namespace.svc",
			want: `issuer.discoveryURL: Invalid value: "http://oidc.oidc-namespace.svc": URL scheme must be https`,
		},
		{
			name: "url user info is not allowed",
			in:   "https://user:******@****.***-namespace.svc",
			want: `issuer.discoveryURL: Invalid value: "https://user:******@****.***-namespace.svc": URL must not contain a username or password`,
		},
		{

	// metric.
	serviceNoLocalEndpointsTotalInternal := 0
	serviceNoLocalEndpointsTotalExternal := 0

	// Build rules for each service-port.
	for svcName, svc := range proxier.svcPortMap {
		svcInfo, ok := svc.(*servicePortInfo)
		if !ok {
			proxier.logger.Error(nil, "Failed to cast serviceInfo", "serviceName", svcName)
			continue
		}
		protocol := strings.ToLower(string(svcInfo.Protocol()))

      --service-account-key-file="${SERVICE_ACCOUNT_KEY}" \
      --service-account-lookup="${SERVICE_ACCOUNT_LOOKUP}" \
      --service-account-issuer="https://kubernetes.default.svc" \
      --service-account-jwks-uri="https://kubernetes.default.svc/openid/v1/jwks" \
      --service-account-signing-key-file="${SERVICE_ACCOUNT_KEY}" \
      --enable-admission-plugins="${ENABLE_ADMISSION_PLUGINS}" \

	// two Workloads with the following UIDs:
	// - cluster1/networking.istio.io/v1alpha3/ServiceEntry/default/external-svc/endpoint1
	// - cluster1/networking.istio.io/v1alpha3/ServiceEntry/default/external-svc/endpoint2
	//
	// For VMs and other workloads other formats are also supported; for example,
	// a single UID string: "0ae5c03d-5fb3-4eb9-9de8-2bd4b51606ba"

	// This service must exist before the StatefulSet, and is responsible for
	// the network identity of the set. Pods get DNS/hostnames that follow the
	// pattern: pod-specific-string.serviceName.default.svc.cluster.local
	// where "pod-specific-string" is managed by the StatefulSet controller.
	ServiceName string `json:"serviceName" protobuf:"bytes,5,opt,name=serviceName"`

	// This service must exist before the StatefulSet, and is responsible for
	// the network identity of the set. Pods get DNS/hostnames that follow the
	// pattern: pod-specific-string.serviceName.default.svc.cluster.local
	// where "pod-specific-string" is managed by the StatefulSet controller.
	ServiceName string `json:"serviceName" protobuf:"bytes,5,opt,name=serviceName"`

	PRFM	(R8), $25                       // 190180f9
	PRFM	8(R9), $30                      // 3e0580f9
	NOOP                                    // 1f2003d5
	HINT $0                                 // 1f2003d5
	DMB	$1
	SVC

// encryption
	SHA256H	V9.S4, V3, V2                   // 6240095e
	SHA256H2	V9.S4, V4, V3           // 8350095e
	SHA256SU0	V8.S4, V7.S4            // 0729285e
	SHA256SU1	V6.S4, V5.S4, V7.S4     // a760065e