fileModified, errChan := make(chan struct{}), make(chan error)
	go watchFiles(watcher, fileModified, errChan)

	for _, path := range paths {
		if !file.Exists(path) {
			log.Infof("file watcher skipping watch on non-existent path: %v", path)
			continue
		}
		if err := watcher.Add(path); err != nil {
			if closeErr := watcher.Close(); closeErr != nil {
				err = fmt.Errorf("%s: %w", closeErr.Error(), err)
			}
			return nil, err
		}

	p.mu.Lock()
	defer p.mu.Unlock()
	if existing := p.currentPodCache[uid]; existing.Netns != nil {
		if existing.Netns.Inode() == workload.Netns.Inode() {
			workload.Netns.Close()
			// Replace the workload, but keep the old Netns
			p.currentPodCache[uid] = WorkloadInfo{
				Workload: workload.Workload,
				Netns:    existing.Netns,
			}
			// already in cache
			return existing.Netns
		}

func NetnsSet(n NetnsFd) error {
	return errors.New("not implemented")
}

func OpenNetns(nspath string) (NetnsCloser, error) {
	return nil, errors.New("not implemented")
}

// inspired by netns.Do() but with an existing fd.
func NetnsDo(fdable NetnsFd, toRun func() error) error {
	return errors.New("not implemented")

// sysexits to signify some error running istioctl, and use 79-125 as custom
// error codes for other info that we'd like to use to pass info on.
const (
	ExitUnknownError   = 1 // for compatibility with existing exit code
	ExitIncorrectUsage = 64
	ExitDataError      = 65 // some format error with input data

	// below here are non-zero exit codes that don't indicate an error with istioctl itself

		// pod was added to our cache
		// we get here in 2 cases:
		// 1. new pod was created on our node
		// 2. we were restarted and current existing pods are added to our cache

		// We have no good way to distinguish between these two cases from here. But we don't need to!
		// Existing pods will be handled by the dataplane using `GetAmbientPods`,
		// and the initial enqueueNamespace, and new pods will be handled by the CNI.

	if err := unix.Setns(int(n.Fd()), unix.CLONE_NEWNET); err != nil {
		return fmt.Errorf("Error switching to ns fd %v: %v", n.Fd(), err)
	}
	return nil
}

// inspired by netns.Do() but with an existing fd.
func NetnsDo(fdable NetnsFd, toRun func() error) error {
	containedCall := func() error {
		threadNS, err := netns.GetCurrentNS()
		if err != nil {
			return fmt.Errorf("failed to open current netns: %v", err)
		}

	}
	return result
}

// PreviousInstallExists checks whether there is an existing Istio installation. Should be used in installer when deciding
// whether to make an installation the default.
func PreviousInstallExists(ctx context.Context, client kubernetes.Interface) bool {

// See the License for the specific language governing permissions and
// limitations under the License.

// This tests the k8s installation.  It validates the CNI plugin configuration
// and the existence of the CNI plugin binary locations.
package install_test

import (
	"testing"

	install "istio.io/istio/cni/test"
	"istio.io/istio/pkg/test/env"
)

var (
	Hub = "gcr.io/istio-release"

	kubeconfig := *r.kubeconfig
	if kubeconfig != "" {
		// use specified kubeconfig file for the location of the
		// config to read
		configAccess.GlobalFile = kubeconfig
	}

	// gets existing kubeconfig or returns new empty config
	config, err := configAccess.GetStartingConfig()
	if err != nil {
		r.defaultNamespace = v1.NamespaceDefault
		return
	}

	if err != nil {
		return kubeconfig{}, err
	}

	return kubeconfig{
		Full:     string(fullYaml),
		Redacted: string(redacted),
	}, nil
}

// maybeWriteKubeConfigFile will validate the existing kubeConfig file, and rewrite/replace it if required.
func maybeWriteKubeConfigFile(cfg *config.InstallConfig) error {
	kc, err := createKubeConfig(cfg)
	if err != nil {
		return err
	}