"golang.org/x/sys/unix"
)

func AddInpodMarkIPRule(cfg *Config) error {
	err := forEachInpodMarkIPRule(cfg, netlink.RuleAdd)
	if errors.Is(err, unix.EEXIST) {
		log.Debugf("Ignoring exists error adding inpod mark ip rule: %v", err)
		return nil
	}
	return err
}

func DelInpodMarkIPRule(cfg *Config) error {
	return forEachInpodMarkIPRule(cfg, netlink.RuleDel)
}

			if wasReady != nil && isReady != nil && isAnnotated {
				log.Infof("Pod %s update event skipped, added/labeled by CNI plugin", pod.Name)
				return nil
			}

			log.Debugf("Pod %s now matches, adding to mesh", newPod.Name)
			// netns == ""; at this point netns should have been added via the initial snapshot,
			// or via the cni plugin. If it happens to get here before the cni plugin somehow,

	if err != nil {
		return nil, fmt.Errorf("error configuring iptables: %w", err)
	}

	// Create hostprobe rules now, in the host netns
	// Later we will reuse this same configurator inside the pod netns for adding other rules
	iptablesConfigurator.DeleteHostRules()

	if err := iptablesConfigurator.CreateHostRulesForHealthChecks(&HostProbeSNATIP, &HostProbeSNATIPV6); err != nil {

			output, fErr := runCommand(c.args)
			verifyProfileDiffCommandCaseOutput(t, c, output, fErr)
		})
	}
}

func TestProfileDiffDirect(t *testing.T) {
	cases := []profileDiffTestcase{
		{
			// We won't be parsing with Cobra, but this is the command equivalent
			args: "profile diff default openshift",
			// This is just one of the many differences
			expectedString: "+    profile: openshift",

	},
}

var ManifestsFlagHelpStr = `Specify a path to a directory of charts and profiles
(e.g. ~/Downloads/istio-` + binversion.OperatorVersionString + `/manifests).`

// CommandParseError distinguishes an error parsing istioctl CLI arguments from an error processing
type CommandParseError struct {
	Err error
}

func (c CommandParseError) Error() string {
	return c.Err.Error()
}

// and iptables will be smart enough to pick the correct underlying set (v4 or v6, based on context),
// reducing the # of rules we need.
//
// BUT netlink lib doesn't support adding things to `list:set` types yet, and current tagged release
// doesn't support creating `list:set` types yet (is in main branch tho).
// So this will actually create 2 underlying ipsets, one for v4 and one for v6

	"istio.io/istio/pkg/kube"
	"istio.io/istio/pkg/log"
)

// installerScope is the scope for all commands in the mesh package.
var installerScope = log.RegisterScope("installer", "installer")

func init() {
	// adding to remove message about the controller-runtime logs not getting displayed
	// We cannot do this in the `log` package since it would place a runtime dependency on controller-runtime for all binaries.

1. The `caClient` will be configured to use either JWT or mTLS authentication. For JWT authentication, gRPC's `PerRPCCredentials`
   is configured with a `TokenProvider` which handles the logic of adding the proper JWT to each request. mTLS is configured
   by a tls.Config that points to files on disk.

It should be noted there is a circular dependency with mTLS authentication; in order to fetch a certificate we need

message Unknown {
  optional TypeMeta typeMeta = 1;

  // Raw will hold the complete serialized object which couldn't be matched
  // with a registered type. Most likely, nothing should be done with this
  // except for passing it through the system.
  optional bytes raw = 2;

  // ContentEncoding is encoding used to encode 'Raw' data.
  // Unspecified means no encoding.
  optional string contentEncoding = 3;

Construction should create informers (via `kclient.New`), setup a queue (via `controllers.NewQueue`), and register event handlers on the informers.
Often, these handlers are adding something to the queue like `client.AddEventHandler(controllers.ObjectHandler(queue.AddObject))`.
Construction should NOT actually start running all of these things, do I/O, or block in anyway.