allowPrivilegeEscalation: false
          capabilities:
            drop:
            - all
          readOnlyRootFilesystem: true
        volumeMounts:
        - mountPath: /tmp/k8s-webhook-server/serving-certs
          name: cert
          readOnly: true
      nodeSelector:
        kubernetes.io/os: linux
      securityContext:
        fsGroup: 65534
        runAsNonRoot: true

s \ --dry-run=client -oyaml \ --from-file=pilot-dashboard.json="${TMP}/pilot-dashboard.json" \ --from-file=istio-performance-dashboard.json="${TMP}/istio-performance-dashboard.json" echo -e "\n---\n" kubectl create configmap -n istio-system istio-services-grafana-dashboards \ --dry-run=client -oyaml \ --from-file=istio-workload-dashboard.json="${TMP}/istio-workload-dashboard.json" \ --from-file=istio-service-dashboard.json="${TMP}/istio-service-dashboard.json" \ --from-file=istio-mesh-dashboard....

		netServer:  fs,
	}

	handlers := setupHandlers(ctx, client, dpServer, "istio-system")

	// We are not going to start the server, so the sockpath is irrelevant
	pluginServer := startCniPluginServer(ctx, "/tmp/test.sock", handlers, dpServer)

	// label the namespace
	labelsPatch := []byte(fmt.Sprintf(`{"metadata":{"labels":{"%s":"%s"}}}`,
		constants.DataplaneModeLabel, constants.DataplaneModeAmbient))