// CSIStorageCapacity objects with capacity information, if set to true.
  //
  // The check can be enabled immediately when deploying a driver.
  // In that case, provisioning new volumes with late binding
  // will pause until the driver deployment has published
  // some suitable CSIStorageCapacity object.
  //
  // Alternatively, the driver can be deployed with the field

  // The completion time is only set when the job finishes successfully.
  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.Time completionTime = 3;

  // The number of pending and running pods.
  // +optional
  optional int32 active = 4;

  // The number of pods which reached phase Succeeded.
  // +optional
  optional int32 succeeded = 5;

	s.ztunnelServer.Close()
}

func (s *NetServer) rescanPod(pod *corev1.Pod) error {
	// this can happen if the pod was dynamically added to the mesh after it was created.
	// in that case, try finding the netns using procfs.
	filter := map[types.UID]*corev1.Pod{
		pod.UID: pod,
	}
	return s.scanProcForPodsAndCache(filter)
}

func (s *NetServer) getOrOpenNetns(pod *corev1.Pod, netNs string) (Netns, error) {

```

This installs the controller into the cluster in the istio-operator namespace. The controller in turns installs
the Istio control plane into the istio-system namespace by default.

### Controller (running locally)

1. Set env $WATCH_NAMESPACE (default value is "istio-system") and $LEADER_ELECTION_NAMESPACE (default value is "istio-operator")

	if err != nil {
		return fmt.Errorf("failed to get profile, namespace or enabled components: %v", err)
	}

	// Ignore the err because we don't want to show
	// "no running Istio pods in istio-system" for the first time
	_ = detectIstioVersionDiff(p, tag, ns, kubeClient, iop)
	exists := revtag.PreviousInstallExists(context.Background(), kubeClient.Kube())

When fetching certificates, ztunnel will authenticate to the CA with its own identity, but request the identity of another workload.
Critically, the CA must enforce that the ztunnel has permission to request that identity.
Requests for identities not running on the node are rejected.

  //
  // The size of this field is limited to 128. This is large enough for
  // many clusters. Larger clusters may need more attempts to find a node
  // that suits all pending resources. This may get increased in the
  // future, but not reduced.
  //
  // +listType=set
  // +optional
  repeated string potentialNodes = 2;
}

  // `url` gives the location of the webhook, in standard URL form
  // (`scheme://host:port/path`). Exactly one of `url` or `service`
  // must be specified.
  //
  // The `host` should not refer to a service running in the cluster; use
  // the `service` field instead. The host might be resolved via external
  // DNS in some apiservers (e.g., `kube-apiserver` cannot resolve

  // `kubernetes.io/ingress.class` annotation (simple constant name) was never
  // formally defined, it was widely supported by Ingress controllers to create
  // a direct binding between Ingress controller and Ingress resources. Newly
  // created Ingress resources should prefer using the field. However, even
  // though the annotation is officially deprecated, for backwards compatibility

		fmt.Sprintf("Comma-separated minimum per-logger level of messages to output, in the form of"+
			" [<logger>:]<level>,[<logger>:]<level>,... or <level> to change all active loggers, "+
			"where logger components can be listed by running \"istioctl proxy-config log <pod-name[.namespace]>\""+
			"or referred from https://github.com/envoyproxy/envoy/blob/main/source/common/common/logger.h, and level can be one of %s", levelListString))
	return logCmd
}