wantUnchanged := sets.New[string]()
	for _, c := range current {
		n := newByName[c.Name]
		if n == nil {
			// We had a resource, but SotW didn't generate it.
			if watched.Contains(c.Name) {
				// We only need to delete it if Envoy is watching. Otherwise, it may have simply unsubscribed
				wantDeleted.Insert(c.Name)
			}
		} else if diff := cmp.Diff(c.Resource, n.Resource, protocmp.Transform()); diff != "" {

	return maps.Clone(p.currentPodCache)
}

// Remove and return the Netns for the given uid
// No need to return NetnsCloser here it will be closed automatically on GC.
// (it may be used in parallel by other parts of the code, so we want it to be used only when not used)
func (p *podNetnsCache) Take(uid string) Netns {
	// lock current pod map
	p.mu.Lock()
	defer p.mu.Unlock()

	res := []T{}
	found := sets.New[Key[T]]()
	for _, c := range j.collections {
		for _, i := range c.List() {
			key := GetKey(i)
			if !found.InsertContains(key) {
				// Only keep it if it is the first time we saw it, as our merging mechanism is to keep the first one
				res = append(res, i)
			}
		}
	}
	return res
}

func (j *join[T]) Register(f func(o Event[T])) Syncer {

			// Each log is 2x: one direct, and one over UDS. Just test the UDS one
			continue
		}
		// remove scope since it is constant and not needed to test
		delete(parsedLog, "scope")
		// check time is there
		if _, f := parsedLog["time"]; !f {
			t.Fatalf("log %v did not have time", i)
		}
		// but remove time since it changes on each test
		delete(parsedLog, "time")
		want := map[string]any{
			"level": cases[i].level,

The installation process using the Helm charts is as follows:

1) `base` chart creates cluster-wide CRDs, cluster bindings and cluster resources. It is possible to change the namespace from `istio-system` but it is not recommended.

```console
helm install istio-base -n istio-system manifests/charts/base --set profile=openshift
```

apiVersion: release-notes/v2
kind: feature
area: istioctl
issue:
  - 50790
releaseNotes:
- |

		// At high QPS (>250 QPS) we will log the same amount as we will log due to exceeding buffer size, rather
		// than the flush interval.
		"--file-flush-interval-msec", "1000",
		"--disable-hot-restart", // We don't use it, so disable it to simplify Envoy's logic
		"--allow-unknown-static-fields",
	}

	startupArgs = append(startupArgs, e.extraArgs...)

	if overrideFname != "" {
		s, err := readBootstrapToJSON(overrideFname)

	// Go through all cluster endpoints and add those with the same network as the sidecar
	// to the result. Also count the number of endpoints per each remote network while
	// iterating so that it can be used as the weight for the gateway endpoint
	for _, ep := range endpoints {
		lbEndpoints := &LocalityEndpoints{
			llbEndpoints: endpoint.LocalityLbEndpoints{
				Locality: ep.llbEndpoints.Locality,

ambient mode no longer use the original service account or namespace attachment semantics. If you were using a namespace-scope waypoint previously migration should be fairly straight forward. Annotate your namespace with the appropriate waypoint and it should function in a similar way.

      If you were using service account attachment there will be more to understand. Under the old waypoint logic all types of traffic, both addressed to a service as well as addressed to a workload, were treated...

		// Log sync will send logs to install-cni container via UDS.
		// We don't need a timeout here because underlying the log pkg already handles it.
		// this may fail, but it should be safe to ignore according
		// to https://github.com/uber-go/zap/issues/328
		_ = log.Sync()
	}()

	// TODO: implement plugin version
	funcs := skel.CNIFuncs{
		Add:   plugin.CmdAdd,
		Del:   plugin.CmdDelete,
		Check: plugin.CmdCheck,
	}