These operate in a similar manner as [`controller-runtime`](https://github.com/kubernetes-sigs/controller-runtime) but are *far* smaller and less abstract.

With a few exceptions, Istio controllers typically are split in two phases: construction and running.

Construction should create informers (via `kclient.New`), setup a queue (via `controllers.NewQueue`), and register event handlers on the informers.

// See the License for the specific language governing permissions and
// limitations under the License.

// This is a sample chained plugin that supports multiple CNI versions. It
// parses prevResult according to the cniVersion
package plugin

type iptables struct{}

func newIPTables() InterceptRuleMgr {
	return &iptables{}

// See the License for the specific language governing permissions and
// limitations under the License.

// This is a sample chained plugin that supports multiple CNI versions. It
// parses prevResult according to the cniVersion
package plugin

import "errors"

// ErrNotImplemented is returned when a requested feature is not implemented.
var ErrNotImplemented = errors.New("not implemented")

						Namespace: "istio-system",
						Labels: map[string]string{
							"app":                 "istiod",
							label.IoIstioRev.Name: c.revision,
						},
					},
					Status: corev1.PodStatus{
						Phase: corev1.PodRunning,
					},
				}, metav1.CreateOptions{})
				assert.NoError(t, err)
			}
			verifyExecTestOutput(t, XdsStatusCommand(ctx), c)
		})
	}
}

			return result, nil
		}
		result.SecretMeta = meta
		result.Valid = meta.Valid
		return result, nil
	}
	result.Valid = false
	return result, nil
}

// GetEnvoySecrets parses the secrets section of the config dump into []SecretItem
func GetEnvoySecrets(
	wrapper *configdump.Wrapper,
) ([]SecretItem, error) {
	secretConfigDump, err := wrapper.GetSecretConfigDump()
	if err != nil {

  //
  // IfHealthyBudget policy means that running pods (status.phase="Running"),
  // but not yet healthy can be evicted only if the guarded application is not
  // disrupted (status.currentHealthy is at least equal to status.desiredHealthy).
  // Healthy pods will be subject to the PDB for eviction.
  //
  // AlwaysAllow policy means that all running pods (status.phase="Running"),

"This is not json"

				{
					EphemeralContainerCommon: corev1.EphemeralContainerCommon{
						Name: "debugger",
					},
				},
			},
		},
		Status: corev1.PodStatus{
			Phase: corev1.PodRunning,
		},
	}
}

func attachDeploy(ns string) *appsv1.Deployment {
	return &appsv1.Deployment{
		ObjectMeta: metav1.ObjectMeta{
			Name:      "foo",
			Namespace: ns,
		},

// See the License for the specific language governing permissions and
// limitations under the License.

// This is a sample chained plugin that supports multiple CNI versions. It
// parses prevResult according to the cniVersion
package plugin

import (
	"fmt"

	"github.com/containernetworking/plugins/pkg/ns"

	"istio.io/istio/pkg/log"
	"istio.io/istio/tools/istio-iptables/pkg/cmd"

// state of a system.
message CarpStatus {
  // Current condition of the carp.
  // More info: http://kubernetes.io/docs/user-guide/carp-states#carp-phase
  // +optional
  optional string phase = 1;

  // Current service state of carp.
  // More info: http://kubernetes.io/docs/user-guide/carp-states#carp-conditions
  // +optional
  repeated CarpCondition conditions = 2;