spec:
      containers:
      - image: fake.docker.io/google-samples/hello-go-gke:1.0
        name: hello
        resources: {}
      - args:
        - proxy
        - sidecar
        - --domain
        - $(POD_NAMESPACE).svc.cluster.local
        - --proxyLogLevel=warning
        - --proxyComponentLogLevel=misc:error
        - --log_output_level=default:info
        env:
        - name: PILOT_CERT_PROVIDER

	return sid.Copy()
}

// LookupSID retrieves a security identifier SID for the account
// and the name of the domain on which the account was found.
// System specify target computer to search.
func LookupSID(system, account string) (sid *SID, domain string, accType uint32, err error) {
	if len(account) == 0 {
		return nil, "", 0, syscall.EINVAL
	}
	acc, e := UTF16PtrFromString(account)

	// The hostname of the Pod, by default equals to pod name.
	hostname string
	// If specified, the fully qualified Pod hostname will be "<hostname>.<subdomain>.<pod namespace>.svc.<cluster domain>".
	subDomain string
	// If in k8s, the node where the pod resides
	nodeName string
}

func (c *Controller) NewEndpointBuilder(pod *v1.Pod) *EndpointBuilder {

	DefaultRootCertFilePath = "./etc/certs/root-cert.pem"

	// WorkloadIdentitySocketPath is the well-known path to the Unix Domain Socket for SDS.
	WorkloadIdentitySocketPath = "./var/run/secrets/workload-spiffe-uds/socket"

	// CredentialNameSocketPath is the well-known path to the Unix Domain Socket for Credential Name.
	CredentialNameSocketPath = "./var/run/secrets/credential-uds/socket"

type RemoteKubeClientGetter func(clusterID cluster.ID) kubernetes.Interface

// KubeJWTAuthenticator authenticates K8s JWTs.
type KubeJWTAuthenticator struct {
	// holder of a mesh configuration for dynamically updating trust domain
	meshHolder mesh.Holder

	// Primary cluster kube client
	kubeClient kubernetes.Interface
	// Primary cluster ID
	clusterID cluster.ID

	// remote cluster kubeClient getter

        sidecar.istio.io/inject: "false"
        topology.istio.io/network: network-1
    spec:
      containers:
      - args:
        - proxy
        - waypoint
        - --domain
        - $(POD_NAMESPACE).svc.<no value>
        - --serviceCluster
        - namespace.$(POD_NAMESPACE)
        - --proxyLogLevel
        - <nil>
        - --proxyComponentLogLevel
        - <nil>

        sidecar.istio.io/inject: "false"
        topology.istio.io/network: network-1
    spec:
      containers:
      - args:
        - proxy
        - waypoint
        - --domain
        - $(POD_NAMESPACE).svc.<no value>
        - --serviceCluster
        - namespace.$(POD_NAMESPACE)
        - --proxyLogLevel
        - <nil>
        - --proxyComponentLogLevel
        - <nil>

                foo.convention("other")
            }
        """

        expect:
        succeeds 'mytask'
    }

    def "emits deprecation warning when convention mapping is used with Provider in domain object other than task"() {
        buildFile << """
            abstract class MyExtension {
                abstract Property<String> getOther()

                Provider<String> getFoo() {

          # only setup the /readiness HTTP server once that's available.
          initialDelaySeconds: 3
          timeoutSeconds: 5
        args:
        - --domain=dns_domain.
        - --dns-port=10053
        - --config-dir=/kube-dns-config
        - --v=2
        env:
        - name: PROMETHEUS_PORT
          value: "10055"
        ports:

// mDNS, and may use platform-dependent DNS stub resolver if possible.
// The APIs accept any of forms for a query; host name in various
// encodings, UTF-8 encoded net name, domain name, FQDN or absolute
// FQDN, but the result would be one of the forms and it depends on
// the circumstances.

var lookupGoogleSRVTests = []struct {
	service, proto, name string
	cname, target        string
}{