connect-time load balancer is required for the host to be able to
                  reach Kubernetes services and it improves the performance of pod-to-service
                  connections.  The only reason to disable it is for debugging purposes.
                  This will be deprecated. Use BPFConnectTimeLoadBalancing [Default:
                  true]'
                type: boolean

	SelectorString string

	// The regex specifying which tests to skip. This follows inverted semantics of golang's
	// -test.run flag, which only supports positive match. If an entire package is meant to be
	// excluded, it can be filtered with `go list` and explicitly passing the list of desired
	// packages. For example: `go test $(go list ./... | grep -v bad-package)`.
	SkipString  ArrayFlags
	SkipMatcher *Matcher

		// Code defaults
		BinaryPath:     constants.BinaryPathFilename,
		StatNameLength: 189,
		StatusPort:     15020,
	}
}

// DefaultMeshNetworks returns a default meshnetworks configuration.
// By default, it is empty.
func DefaultMeshNetworks() *meshconfig.MeshNetworks {
	return ptr.Of(EmptyMeshNetworks())
}

// DefaultMeshConfig returns the default mesh config.
// This is merged with values from the mesh config map.

							param.Namespace.String(): apps.Ns1.Namespace,
						})).
						// It's not trivial to force mTLS to pass-through ports. To work around this, we will
						// set up a SE and DR that forces it.
						//
						// Since our client will talk directly to pods via IP, we have to configure the ports
						// in the SE as TCP, since only TCP does will match based in IP address rather than host.

)

// Analyze implements Analyzer
func (s *ExternalControlPlaneAnalyzer) Analyze(c analysis.Context) {
	reportWebhookURL := func(r *resource.Instance, hName string, clientConf v1.WebhookClientConfig) {
		// If defined, it means that an external istiod has been adopted
		if clientConf.URL != nil {
			result, err := lintWebhookURL(*clientConf.URL)
			if err != nil {

//
// See: xds/internal/httpfilter/rbac
//
// TODO: gRPC also supports 'per route override' - not yet clear how to use it, Istio uses path expressions instead and we don't generate
// vhosts or routes for the inbound listener.
//
// For gateways it would make a lot of sense to use this concept, same for moving path prefix at top level ( more scalable, easier for users)
// This should probably be done for the v2 API.

          pid="$$$$"

          # Run the pilot agent and Envoy
          # TODO: run with systemctl?
          # Setup a script to start istio but exit the container if it exits. This more closely mirrors Pods.
          # This is not strictly needed, but it makes our CI properly report crashes (including core dumps)
          cat <<'EOF'>/tmp/start.sh
          #!/bin/bash
          /usr/local/bin/istio-start.sh
          kill "$1"

	log.Debugf("netns: %s", addCmd.Netns)

	// The CNI node plugin should have already checked the pod against the k8s API before forwarding us the event,
	// but we have to invoke the K8S client anyway, so to be safe we check it again here to make sure we get the same result.
	ambientPod, err := s.getPodWithRetry(log, addCmd.PodName, addCmd.PodNamespace)
	if err != nil {
		return err
	}

// BuildClientConfig builds a client rest config from a kubeconfig filepath and context.
// It overrides the current context with the one provided (empty to use default).
//
// This is a modified version of k8s.io/client-go/tools/clientcmd/BuildConfigFromFlags with the
// difference that it loads default configs if not running in-cluster.
func BuildClientConfig(kubeconfig, context string) (*rest.Config, error) {

          - extensions.istio.io
        apiVersions:
          - "*"
        resources:
          - "*"

    {{- if .Values.base.validationCABundle }}
    # Disable webhook controller in Pilot to stop patching it
    failurePolicy: Fail
    {{- else }}
    # Fail open until the validation webhook is ready. The webhook controller
    # will update this to `Fail` and patch in the `caBundle` when the webhook
    # endpoint is ready.