1. The controller does not accept any dynamic user config through flags. All user interaction is through the
IstioOperator CR.
1. The controller has additional logic that mirrors istioctl commands like upgrade, but is driven from the declarative
API rather than command line.

### Quick tour of CLI commands

#### Flags

The `istioctl` command supports the following flags:

	# endpoint: ENDPOINT
	# credentials:
	#   accessKey: ACCESS-KEY
	#   secretKey: SECRET-KEY
	#   sessionToken: SESSION-TOKEN # Available when rotating credentials are used

  # optional flags based filtering criteria
  # for all source objects
  flags:
	filter:
	  newerThan: "7d" # match objects newer than this value (e.g. 7d10h31s)
	  olderThan: "7d" # match objects older than this value (e.g. 7d10h31s)

or copying the `go` binary.

### Vet {#vet}

The `go vet` subcommand now includes the
[stdversion](https://beta.pkg.go.dev/golang.org/x/tools/go/analysis/passes/stdversion)
analyzer, which flags references to symbols that are too new for the version
of Go in effect in the referring file. (The effective version is determined
by the `go` directive in the file's enclosing `go.mod` file, and

lifetime based on Response cache headers.

 - CallStart 
 - **CacheMiss**
 - ProxySelectStart
 - ... Standard Events ...
 - CallEnd
        
### Conditional Cache Hit
 
When cache flags require checking the cache results are still valid an early cacheConditionalHit event is
received followed by a cache hit or miss.  Critically in the cache hit scenario the server won’t send the response body.

 VersionID [16]byte  // Version UUID, raw.
 ModTime   int64     // Unix nanoseconds.
 Signature [4]byte   // Signature of metadata.
 Type      uint8     // Type if the version
 Flags     uint8
}
```

The following flags are defined:

```
const (
 FreeVersion = 1 << 0
 UsesDataDir = 1 << 1
 InlineData  = 1 << 2
)
```

the right format for a command (`add_dir_header` instead of `add-dir-header`). Fixing this included cleaning up flag handling in component-base/logs: that package no longer adds flags to the global flag sets. Commands which want the klog and `--log-flush-frequency` flags must explicitly call `logs.AddFlags`; the new `cli.Run` does that for commands. That helper function also covers flag normalization and printing of usage and errors in a consistent way (print usage text first if parsing failed, then...

       That setting must exist for this script to function correctly.
EOF
  exit 1
fi
TFCI_BAZEL_COMMON_ARGS="$TFCI_BAZEL_COMMON_ARGS --config rbe_$TFCI_BAZEL_TARGET_SELECTING_CONFIG_PREFIX"

# These flags share the user's gcloud credentials with the container, so that bazel
# inside the container can authenticate. Note: TF's CI does not have any credential
# stored here.

pkg flag, method (*FlagSet) Visit(func(*Flag))
pkg flag, method (*FlagSet) VisitAll(func(*Flag))
pkg flag, type ErrorHandling int
pkg flag, type Flag struct
pkg flag, type Flag struct, DefValue string
pkg flag, type Flag struct, Name string
pkg flag, type Flag struct, Usage string
pkg flag, type Flag struct, Value Value
pkg flag, type FlagSet struct
pkg flag, type FlagSet struct, Usage func()

# END TF TEST SUITE OPTIONS

# START CROSS-COMPILE CONFIGS
# Set execution platform to Linux x86
# Note: Lot of the "host_" flags such as "host_cpu" and "host_crosstool_top"
# flags seem to be actually used to specify the execution platform details. It
# seems it is this way because these flags are old and predate the distinction
# between host and execution platform.
build:cross_compile_base --host_cpu=k8

yujuhong))

* The Kubelet now explicitly registers all of its command-line flags with an internal flagset, which prevents flags from third party libraries from unintentionally leaking into the Kubelet's command-line API. Many unintentionally leaked flags are now marked deprecated, so that users have a chance to migrate away from them before they are removed. In addition, one previously leaked flag, --cloud-provider-gce-lb-src-cidrs, has been entirely removed from the Kubelet's command-line...