`,
		Example: `  # Retrieve sync status for all Envoys in a mesh
  istioctl x internal-debug syncz

  # Retrieve sync diff for a single Envoy and Istiod
  istioctl x internal-debug syncz istio-egressgateway-59585c5b9c-ndc59.istio-system

  # SECURITY OPTIONS

  # Retrieve syncz debug information directly from the control plane, using token security

	// specialComponentPath lists cases of component path of values.yaml we need to have special treatment.
	specialComponentPath = map[string]bool{
		"gateways":                      true,
		"gateways.istio-ingressgateway": true,
		"gateways.istio-egressgateway":  true,
	}

	skipTranslate = map[name.ComponentName]bool{
		name.IstioBaseComponentName:          true,
		name.IstioOperatorComponentName:      true,

kind: HorizontalPodAutoscaler
metadata:
  name: istio-ingressgateway
  namespace: istio-system
  labels:
    app: istio-ingressgateway
    release: istio`,
			b: `apiVersion: autoscaling/v2
kind: HorizontalPodAutoscaler
metadata:
  name: istio-ingressgateway
  namespace: istio-system
  labels:
    app: istio-egressgateway
    release: istio`,
			want: `metadata:
  labels:

		errs = util.AppendErrs(errs, validateGateways(spec.GetComponents().GetIngressGateways(), "istio-ingressgateway"))
	}
	if !values.GetGateways().GetIstioEgressgateway().GetRunAsRoot().GetValue() {
		errs = util.AppendErrs(errs, validateGateways(spec.GetComponents().GetEgressGateways(), "istio-egressgateway"))
	}
	for _, raw := range values.GetGateways().GetIstioIngressgateway().GetIngressPorts() {
		p := raw.AsMap()

configured. See https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services ipFamilyPolicy: "" ipFamilies: [] secretVolumes: - name: egressgateway-certs secretName: istio-egressgateway-certs mountPath: /etc/istio/egressgateway-certs - name: egressgateway-ca-certs secretName: istio-egressgateway-ca-certs mountPath: /etc/istio/egressgateway-ca-certs configVolumes: [] additionalContainers: [] serviceAccount: # Annotations to add to the service account annotations: {} ### Advanced options...

		args.AppendSet("meshConfig.defaultConfig.proxyMetadata.ISTIO_DUAL_STACK", "true")
		args.AppendSet("values.gateways.istio-ingressgateway.ipFamilyPolicy", "RequireDualStack")
		args.AppendSet("values.gateways.istio-egressgateway.ipFamilyPolicy", "RequireDualStack")
	}

	// Include all user-specified values.
	for k, v := range cfg.Values {
		args.AppendSet("values."+k, v)
	}

# Gateway with non-standard IngressGateway
#
apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: httpbin-gateway
spec:
  selector:
    myapp: private-ingressgateway
  servers:
  - port:
      number: 8003
      name: http2
      protocol: HTTP
    hosts:
    - "*"
---
apiVersion: v1
kind: Pod
metadata:
  labels:
    myapp: private-ingressgateway
  name: my-ingressgateway-1234
spec:

    hosts:
    - "*"
---
apiVersion: v1
kind: Pod
metadata:
  labels:
    myapp: ingressgateway-8001
  name: my-ingressgateway-8001
spec:
  containers:
    - args:
      name: istio-proxy
---
apiVersion: v1
kind: Pod
metadata:
  labels:
    myapp: ingressgateway-8002
  name: my-ingressgateway-8002
spec:
  containers:
    - args:
      name: istio-proxy
---
apiVersion: v1

# Gateway with non-standard IngressGateway
#
apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: httpbin-gateway
spec:
  selector:
    myapp: private-ingressgateway
  servers:
  - port:
      number: 8004
      name: http2
      protocol: HTTP
    hosts:
    - "*"
---
apiVersion: v1
kind: Pod
metadata:
  labels:
    myapp: private-ingressgateway
  name: my-ingressgateway-1234
spec:

# Gateway with non-standard IngressGateway
#
apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: httpbin-gateway
spec:
  selector:
    myapp: private-ingressgateway
  servers:
  - port:
      number: 80
      name: http2
      protocol: HTTP
    hosts:
    - "*"
---
apiVersion: v1
kind: Pod
metadata:
  labels:
    myapp: private-ingressgateway
  name: my-ingressgateway-1234
spec: