func generateMutatingWebhook(config *tagWebhookConfig, opts *GenerateOptions) (string, error) {
	flags := []string{
		"installPackagePath=" + opts.ManifestsPath,
		"profile=empty",
		"components.pilot.enabled=true",
		"revision=" + config.Revision,
		"values.revisionTags.[0]=" + config.Tag,

                .longOpt("activate-profiles")
                .desc(
                        "Comma-delimited list of profiles to activate. Prefixing a profile with ! excludes it, and ? marks it as optional")
                .hasArg()
                .build());
        options.addOption(Option.builder(Character.toString(BATCH_MODE))
                .longOpt("batch-mode")

}

// SeccompProfile defines a pod/container's seccomp profile settings.
// Only one profile source may be set.
// +union
message SeccompProfile {
  // type indicates which kind of seccomp profile will be applied.
  // Valid options are:
  //
  // Localhost - a profile defined in a file on the node should be used.
  // RuntimeDefault - the container runtime default profile should be used.

    - jsonPath: .spec.peerAddress
      name: Address
      type: string
    - jsonPath: .spec.peerASN
      name: ASN
      type: string
    - jsonPath: .spec.bfdProfile
      name: BFD Profile
      type: string
    - jsonPath: .spec.ebgpMultiHop
      name: Multi Hops
      type: string
    name: v1beta1
    schema:
      openAPIV3Schema:

     *     <li>User properties (highest precedence)</li>
     * </ul>
     * Note: Project properties contains properties injected from profiles, if applicable. Their precedence is
     * {@code profile > project}, hence active profile property may override project property.
     * <p>
     * The caller of this method should decide whether there is a project in scope (hence, a project instance
     * needs to be passed) or not.
     *

  existingClientSecretName: ""
  existingClientIdKey: ""
  existingClientSecretKey: ""
  claimName: "policy"
  scopes: "openid,profile,email"
  redirectUri: "https://console-endpoint-url/oauth_callback"
  # Can leave empty
  claimPrefix: ""
  comment: ""
  displayName: ""

networkPolicy:
  enabled: false

export MINIO_IDENTITY_OPENID_CLIENT_ID="843351d4-1080-11ea-aa20-271ecba3924a"
# Optional: Allow to specify the requested OpenID scopes (OpenID only requires the `openid` scope)
#export MINIO_IDENTITY_OPENID_SCOPES="openid,profile,email"
minio server /mnt/export
```

or using `mc`

```
mc admin config get myminio identity_openid

		// Profiling operations
		adminRouter.Methods(http.MethodPost).Path(adminVersion + "/profile").HandlerFunc(adminMiddleware(adminAPI.ProfileHandler, traceHdrsS3HFlag, noObjLayerFlag))

		// Config KV operations.
		if enableConfigOps {

		// User chose not to automatically create the service account.
		return nil, fmt.Errorf("failed retrieving service account %s.%s required for creating "+
			"the remote secret (hint: try installing a minimal Istio profile on the cluster first, "+
			"or run with '--create-service-account=true'): %v",
			opt.ServiceAccountName,
			opt.Namespace,
			err)
	}

	if err := createServiceAccount(client, opt); err != nil {

				return nil
			}

			for typ, data := range data {
				// zip writer only handles one concurrent write
				writeMu.Lock()
				profilingDataFound = true
				err := embedFileInZip(zipWriter, fmt.Sprintf("profile-%s-%s", client.host.String(), typ), data, 0o600)
				writeMu.Unlock()
				if err != nil {
					reqInfo := (&logger.ReqInfo{}).AppendTags("peerAddress", client.host.String())
					ctx := logger.SetReqInfo(ctx, reqInfo)