// used rather than just deleting the webhook since we want to keep it around after changing the default so user can later
// switch back to it. This is a hack but it is meant to cover a corner case where a user wants to migrate from a non-revisioned
// old version and then later decides to switch back to the old revision again.
func DeactivateIstioInjectionWebhook(ctx context.Context, client kubernetes.Interface) error {

  // is returned in the status.audiences field to ensure that the TokenReview
  // server is audience aware. If a TokenReview returns an empty
  // status.audience field where status.authenticated is "true", the token is
  // valid against the audience of the Kubernetes API server.
  // +optional
  repeated string audiences = 4;

  // Error indicates that the token couldn't be checked

	K8sServiceProtocol string
	// KUBERNETES_SERVICE_HOST
	K8sServiceHost string
	// KUBERNETES_SERVICE_PORT
	K8sServicePort string
	// KUBERNETES_NODE_NAME
	K8sNodeName string

	// Directory from where the CNI binaries should be copied
	CNIBinSourceDir string
	// Directories into which to copy the CNI binaries
	CNIBinTargetDirs []string

	// The HTTP port for monitoring
	MonitoringPort int

			}
		}
	}
	return w.Flush()
}

func valueOrNA(value string) string {
	if value == "" {
		return "NA"
	}
	return value
}

func certNotExpired(cert *Cert) bool {
	// case where cert state is in either Initializing or Unavailable state
	if cert.ExpirationTime == "" && cert.ValidFrom == "" {
		return false
	}
	today := time.Now()
	expDate, err := time.Parse(time.RFC3339, cert.ExpirationTime)

    imagePullSecrets: []

    # Used to locate istiod.
    istioNamespace: istio-system

    externalIstiod: false
    remotePilotAddress: ""

    # Platform where Istio is deployed. Possible values are: "openshift", "gcp".
    # An empty value means it is a vanilla Kubernetes distribution, therefore no special
    # treatment will be considered.
    platform: ""

    - port: 80
      targetPort: 8080
      name: http2
    - port: 443
      targetPort: 8443
      name: https
    - port: 31400
      targetPort: 31400
      name: tcp
      # This is the port where sni routing happens
    - port: 15443
      targetPort: 15443
      name: tls
    resources:
      requests:
        cpu: 10m

      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
      (except as stated in this section) patent license to make, have made,
      use, offer to sell, sell, import, and otherwise transfer the Work,
      where such license applies only to those patent claims licensable
      by such Contributor that are necessarily infringed by their
      Contribution(s) alone or by combination of their Contribution(s)

	// If false, generic defaults will be used. This is useful when generating once and then applying later.
	EnableClusterSpecific bool

	// Set is a string with element format "path=value" where path is an IstioOperator path and the value is a
	// value to set the node at that path to.
	Set []string
	// Force proceeds even if there are validation errors
	Force bool

// /var/run/netns/<name>. However, this pattern is not ubiquitous. Some platforms bind mount to other places. As we run
// in a pod, we cannot just access any arbitrary file they happen to bind mount in, as we don't know ahead of time where
// it might be.
//
// Instead, we rely directly on the procfs.
// This rules out two possible methods:
// * use crictl to inspect the pod; this returns the bind-mounted network namespace file.

			"changed paths with the value changes shown as OLD-VALUE -> NEW-VALUE.\n" +
			"List order changes are shown as [OLD-INDEX->NEW-INDEX], with ? used where a list item is added or\n" +
			"removed.",
		Args: func(cmd *cobra.Command, args []string) error {
			if len(args) != 2 {
				return fmt.Errorf("diff requires two files or directories")
			}
			return nil
		},