},
      "last_updated": "2023-06-20T09:07:42.038Z"
     }
    },
    {
     "name": "main_internal",
     "active_state": {
      "version_info": "2023-06-20T09:07:41Z/3",
      "listener": {
       "@type": "type.googleapis.com/envoy.config.listener.v3.Listener",
       "name": "main_internal",
       "filter_chains": [
        {
         "filter_chain_match": {

"links": [], "panels": [ { "collapsed": true, "gridPos": { "h": 1, "w": 24, "x": 0, "y": 0 }, "id": 21, "panels": [ { "content": "The charts on this dashboard are intended to show Istio main components cost in terms of resources utilization under steady load.\n\n- **vCPU / 1k rps:** shows vCPU utilization by the main Istio components normalized by 1000 requests/second. When idle or low traffic, this chart will be blank. The curve for istio-proxy refers to the services sidecars only.\n- **vCPU:** vCPU...

  grpc: warning
  hc: warning
  health_checker: warning
  http: warning
  http2: warning
  hystrix: warning
  init: warning
  io: warning
  jwt: warning
  kafka: warning
  lua: warning
  main: warning
  misc: warning
  mongo: warning
  quic: warning
  pool: warning
  rbac: warning
  redis: warning
  router: warning
  runtime: warning
  stats: warning
  secret: warning
  tap: warning

	// Insert jumps to our custom chains
	// This is mostly just for visual tidiness and cleanup, as we can delete the secondary chains and jumps
	// without polluting the main table too much.

	// -t mangle -A PREROUTING -j ISTIO_PRERT
	iptablesBuilder.AppendRule(
		iptableslog.UndefinedCommand, iptablesconstants.PREROUTING, iptablesconstants.MANGLE,
		"-j", ChainInpodPrerouting,
	)

		}
		cniConfigFilepath += "list"
	}

	installLog.Infof("Created CNI config %s", cniConfigFilepath)
	return cniConfigFilepath, nil
}

// If configured as chained CNI plugin, waits indefinitely for a main CNI config file to exist before returning
// Or until cancelled by parent context
func getCNIConfigFilepath(ctx context.Context, cfg pluginConfig) (string, error) {
	filename := cfg.cniConfName

  // Default is false.
  // Note that this field cannot be set when spec.os.name is windows.
  // +optional
  optional bool readOnlyRootFilesystem = 6;

  // AllowPrivilegeEscalation controls whether a process can gain more
  // privileges than its parent process. This bool directly controls if
  // the no_new_privs flag will be set on the container process.
  // AllowPrivilegeEscalation is true always when the container is:

// See the License for the specific language governing permissions and
// limitations under the License.

package main

import (
	"context"
	"os"
	"os/signal"
	"syscall"

	"istio.io/istio/cni/pkg/cmd"
	"istio.io/istio/pkg/log"
)

func main() {
	// Create context that cancels on termination signal
	ctx, cancel := context.WithCancel(context.Background())
	sigChan := make(chan os.Signal, 1)

// parses prevResult according to the cniVersion
package main

import (
	"fmt"
	"os"

	"github.com/containernetworking/cni/pkg/skel"
	"github.com/containernetworking/cni/pkg/version"

	"istio.io/istio/cni/pkg/plugin"
	"istio.io/istio/pkg/log"
	istioversion "istio.io/istio/pkg/version"
)

func main() {
	if err := runPlugin(); err != nil {
		os.Exit(1)
	}
}

NAME                   ADDRESSES PORT  MATCH DESTINATION
listener/main_internal           0     ALL   Cluster: inbound-vip|8100|http|httpbin.default.svc.cluster.local
listener/main_internal           0     ALL   Cluster: inbound-vip|8000|http|httpbin.default.svc.cluster.local
listener/main_internal           0     ALL   Cluster: encap
listener/main_internal           0     ALL   Cluster: encap

// It has extra helper functions for handling any/struct/marshal protobuf pain
type Wrapper struct {
	*admin.Clusters
}

// MarshalJSON is a custom marshaller to handle protobuf pain
func (w *Wrapper) MarshalJSON() ([]byte, error) {
	return protomarshal.Marshal(w)
}

// UnmarshalJSON is a custom unmarshaller to handle protobuf pain
func (w *Wrapper) UnmarshalJSON(b []byte) error {
	cd := &admin.Clusters{}