c.clusters.Delete(string(clusterID))
	if len(c.remoteClusters[secretKey]) == 0 {
		delete(c.remoteClusters, secretKey)
	}
}

func (c *ClusterStore) Get(secretKey string, clusterID cluster.ID) *Cluster {
	c.RLock()
	defer c.RUnlock()
	if _, ok := c.remoteClusters[secretKey]; !ok {
		return nil
	}
	return c.remoteClusters[secretKey][clusterID]
}

func (a *KubeJWTAuthenticator) getKubeClient(clusterID cluster.ID) kubernetes.Interface {
	// first match local/primary cluster
	// or if clusterID is not sent (we assume that its a single cluster)
	if a.clusterID == clusterID || clusterID == "" {
		return a.kubeClient
	}

	// secondly try other remote clusters
	if a.remoteKubeClientGetter != nil {
		if res := a.remoteKubeClientGetter(clusterID); res != nil {
			return res
		}
	}

func ErrorHandlerForCluster(clusterID cluster.ID) cache.WatchErrorHandler {
	mu.RLock()
	handler, ok := handlers[clusterID]
	mu.RUnlock()
	if ok {
		return handler
	}

	mu.Lock()
	defer mu.Unlock()
	clusterMetric := errorMetric.With(clusterLabel.Value(clusterID.String()))
	h := func(_ *cache.Reflector, err error) {
		clusterMetric.Increment()

	proxyID   string
	clusterID string
	version   string

	cdsSyncStatus  status.ConfigStatus
	ldsSyncStatus  status.ConfigStatus
	rdsSyncStatus  status.ConfigStatus
	edsSyncStatus  status.ConfigStatus
	ecdsSyncStatus status.ConfigStatus
}

func newXdsClientConfig(config clientConfigInput) *status.ClientConfig {
	meta := model.NodeMetadata{
		ClusterID:    cluster.ID(config.clusterID),

	}{
		"No bearer token": {
			metadata: metadata.MD{
				"clusterid": []string{primaryCluster},
				"authorization": []string{
					"Basic callername",
				},
			},
			expectedErrMsg: "target JWT extraction error: no bearer token exists in HTTP authorization header",
		},
		"token not authenticated": {
			token: invlidToken,
			metadata: metadata.MD{
				"clusterid": []string{primaryCluster},
				"authorization": []string{

			"spiffe://cluster.local/ns/default/sa/foo-share",
		},
		ClusterID: "",
	})
	ReplicatedFooServiceV2 = MakeService(ServiceArgs{
		Hostname: ReplicatedFooServiceName,
		Address:  "10.3.0.1",
		ServiceAccounts: []string{
			"spiffe://cluster.local/ns/default/sa/foo2",
			"spiffe://cluster.local/ns/default/sa/foo-share",
		},
		ClusterID: "",
	})

		ServiceAccounts: []string{},
		ClusterID:       "cluster-1",
	})
	HelloInstanceV0 := MakeIP(HelloService, 0)

	if HelloInstanceV0 != "10.1.1.0" {
		t.Fatalf("MakeIP() can not handle ip4 address.")
	}

	HelloService1 := MakeService(ServiceArgs{
		Hostname:        "hello.default.svc.cluster.local",
		Address:         "asa",
		ServiceAccounts: []string{},
		ClusterID:       "cluster-1",
	})

	}

	if cloud != nil && !cloud.HasClusterID() {
		if allowUntaggedCloud {
			logger.Info("Warning: detected a cluster without a ClusterID.  A ClusterID will be required in the future.  Please tag your cluster to avoid any future issues")
		} else {
			return nil, loopMode, fmt.Errorf("no ClusterID Found.  A ClusterID is required for the cloud provider to function properly.  This check can be bypassed by setting the allow-untagged-cloud option")
		}
	}

type Component[T ComponentConstraint] struct {
	mu          sync.RWMutex
	constructor func(cluster *Cluster) T
	clusters    map[cluster.ID]T
}

func (m *Component[T]) ForCluster(clusterID cluster.ID) *T {
	m.mu.RLock()
	defer m.mu.RUnlock()
	t, f := m.clusters[clusterID]
	if !f {
		return nil
	}
	return &t
}

func (m *Component[T]) All() []T {
	m.mu.RLock()
	defer m.mu.RUnlock()
	return maps.Values(m.clusters)
}

	})
	return m
}

func (m *Multicluster) ForCluster(clusterID cluster.ID) (credentials.Controller, error) {
	cc := m.component.ForCluster(clusterID)
	if cc == nil {
		return nil, fmt.Errorf("cluster %v is not configured", clusterID)
	}
	agg := &AggregateController{}
	agg.controllers = []*CredentialsController{}
	agg.authController = *cc
	if clusterID != m.configCluster {