// i.e. mounted Secret or external plugin.
	// If present, FileMountedCerts should be true.

	// DefaultCertChainFilePath is the well-known path for an existing certificate chain file
	DefaultCertChainFilePath = "./etc/certs/cert-chain.pem"

	// DefaultKeyFilePath is the well-known path for an existing key file
	DefaultKeyFilePath = "./etc/certs/key.pem"

  {{- end }}
  CNI_NET_DIR: {{ .Values.cni.cniConfDir | default "/etc/cni/net.d" }}
  CHAINED_CNI_PLUGIN: {{ .Values.cni.chained | quote }}
  EXCLUDED_NAMESPACES: "{{ range $idx, $ns := .Values.cni.excludeNamespaces }}{{ if $idx }},{{ end }}{{ $ns }}{{ end }}"
  REPAIR_ENABLED: {{ .Values.cni.chained | quote }}
  REPAIR_LABEL_PODS: {{ .Values.cni.repair.labelPods | quote }}
  REPAIR_DELETE_PODS: {{ .Values.cni.repair.deletePods | quote }}

 * exception which might help the user determine what the failed operation was, or where it took place. Generally, this
 * annotation is only attached to exceptions which chain lower-level exceptions.
 */
@Retention(RetentionPolicy.RUNTIME)
@Target(ElementType.TYPE)
@Inherited
public @interface Contextual {

	"istio.io/istio/pilot/pkg/model"
	"istio.io/istio/pilot/pkg/simulation"
	"istio.io/istio/pilot/test/xds"
)

// TestPeerAuthenticationPassthrough tests the PeerAuthentication policy applies correctly on the passthrough filter chain,
// including both global configuration and port level configuration.
func TestPeerAuthenticationPassthrough(t *testing.T) {
	paStrict := `
apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:

spec:
  ipFamilyPolicy: SingleStack
  ipFamilies:
  - IPv4
  ports:
  - name: tcp
    port: 9000
  - name: tcp-other
    port: 9001
  # Port 9002 is omitted intentionally for testing the pass through filter chain.
  selector:
    app: tcp-echo
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: tcp-echo
spec:
  replicas: 1
  selector:
    matchLabels:
      app: tcp-echo
      version: v1

      serviceAccountName: ip-masq-agent
      hostNetwork: true
      containers:
      - name: ip-masq-agent
        image: registry.k8s.io/networking/ip-masq-agent-amd64:v2.6.1
        args:
          - --masq-chain=IP-MASQ
          - --nomasq-all-reserved-ranges
        resources:
          requests:
            cpu: 10m
            memory: 16Mi
        securityContext:
          privileged: true
        volumeMounts:

     * so it can be called on an instance of [subClass].
     *
     * Basically, it's a composition of inheritance-based substitutions for all the inheritance chain.
     *
     * On the following code:
     * ```
     * class A : B<String>
     * class B<T> : C<T, Int>
     * class C<X, Y>
     * ```
     *

	return cniConfigFilepath, nil
}

// If configured as chained CNI plugin, waits indefinitely for a main CNI config file to exist before returning
// Or until cancelled by parent context
func getCNIConfigFilepath(ctx context.Context, cniConfName, mountedCNINetDir string, chained bool) (string, error) {
	if !chained {
		if len(cniConfName) == 0 {
			cniConfName = "YYY-istio-cni.conf"
		}

        "files.empty"           | "false"
        "files.contains(file1)" | "true"
    }

    @Issue('https://github.com/gradle/gradle/issues/26352')
    def 'intricate ConfigurableFileCollection filter chain carries task dependencies'() {
        given:
        def configurationCache = newConfigurationCacheFixture()

        and:
        buildFile '''
            abstract class ConcatTask extends DefaultTask {

    }

    @Override
    public void startProcessing(TestResultProcessor resultProcessor) {
        TestResultProcessor resultProcessorChain = createResultProcessorChain(resultProcessor);
        // Wrap the result processor chain up in a blocking actor, to make the whole thing thread-safe
        resultProcessorActor = actorFactory.createBlockingActor(resultProcessorChain);
        executor = createTestExecutor(resultProcessorActor);
    }