if c.o.CABundleWatcher == nil {
		return
	}
	id, watchCh := c.o.CABundleWatcher.AddWatcher()
	defer c.o.CABundleWatcher.RemoveWatcher(id)

	for {
		select {
		case <-watchCh:
			c.syncAll()
		case <-stop:
			return
		}
	}
}

func (c *Controller) readyForFailClose() bool {
	if !c.dryRunOfInvalidConfigRejected {
		if rejected, reason := c.isDryRunOfInvalidConfigRejected(); !rejected {

    )
  }

  internal fun redactedUrl(): String = originalRequest.url.redact()

  inner class AsyncCall(
    private val responseCallback: Callback,
  ) : Runnable {
    @Volatile var callsPerHost = AtomicInteger(0)
      private set

    fun reuseCallsPerHostFrom(other: AsyncCall) {
      this.callsPerHost = other.callsPerHost
    }

    val host: String
      get() = originalRequest.url.host

		LongRetry,
	)

	// verify the webhook is updated after the controller can confirm invalid config is rejected.
	gatewayError.Store(ptr.Of[error](kerrors.NewInternalError(errors.New(deniedRequestMessageFragment))))
	c.syncAll()
	assert.EventuallyEqual(
		t,
		fetch(unpatchedWebhookConfig.Name),
		webhookConfigWithCABundleFail,
		retry.Message("istiod config created when endpoint is ready and invalid config is denied"),
		LongRetry,

	return obj
}

// SyncAll simulates the controller periodic sync of volumes and claim. It
// simply adds all these objects to the internal queue of updates. This method
// should be used when the test manually calls syncClaim/syncVolume. Test that
// use real controller loop (ctrl.Run()) will get periodic sync automatically.
func (r *VolumeReactor) SyncAll() {
	r.lock.Lock()
	defer r.lock.Unlock()

type Index interface {
	Lookup(key string) []model.AddressInfo
	All() []model.AddressInfo
	WorkloadsForWaypoint(key model.WaypointKey) []model.WorkloadInfo
	ServicesForWaypoint(key model.WaypointKey) []model.ServiceInfo
	SyncAll()
	HasSynced() bool
	model.AmbientIndexes
}

var _ Index = &index{}

type workloadsCollection struct {
	krt.Collection[model.WorkloadInfo]
	ByAddress        *krt.Index[model.WorkloadInfo, networkAddress]

	ASTD
	ASTI
	ASTMXCSR
	ASTOSB
	ASTOSL
	ASTOSQ
	ASTOSW
	ASTRL
	ASTRQ
	ASTRW
	ASUBB
	ASUBL
	ASUBPD
	ASUBPS
	ASUBQ
	ASUBSD
	ASUBSS
	ASUBW
	ASWAPGS
	ASYSCALL
	ASYSENTER
	ASYSENTER64
	ASYSEXIT
	ASYSEXIT64
	ASYSRET
	ATESTB
	ATESTL
	ATESTQ
	ATESTW
	ATPAUSE
	ATZCNTL
	ATZCNTQ
	ATZCNTW
	AUCOMISD
	AUCOMISS
	AUD1
	AUD2

	ACS
	ACSG

	// serialize
	ASYNC

	// branch
	ABC
	ABCL
	ABRC
	ABEQ
	ABGE
	ABGT
	ABLE
	ABLT
	ABLEU
	ABLTU
	ABNE
	ABVC
	ABVS
	ASYSCALL

	// branch on count
	ABRCT
	ABRCTG

	// compare and branch
	ACRJ
	ACGRJ
	ACLRJ
	ACLGRJ
	ACIJ
	ACGIJ
	ACLIJ
	ACLGIJ
	ACMPBEQ
	ACMPBGE
	ACMPBGT
	ACMPBLE

	ASYNC
	AXOR
	AXORCC
	AXORIS

	ADCBF
	ADCBI
	ADCBST
	ADCBT
	ADCBTST
	ADCBZ
	AEIEIO
	AICBI
	AISYNC
	APTESYNC
	ATLBIE
	ATLBIEL
	ATLBSYNC
	ATW

	ASYSCALL
	AWORD

	ARFCI

	AFCPSGN
	AFCPSGNCC
	/* optional on 32-bit */
	AFRES
	AFRESCC
	AFRIM
	AFRIMCC
	AFRIP
	AFRIPCC
	AFRIZ
	AFRIZCC
	AFRIN
	AFRINCC
	AFRSQRTE

	// With this, the pod do not need to restart when the network configuration changes.
	if c.ambientIndex != nil {
		c.ambientIndex.SyncAll()
	}
}

// reloadMeshNetworks will read the mesh networks configuration to setup
// fromRegistry and cidr based network lookups for this registry
func (n *networkManager) reloadMeshNetworks() {
	n.Lock()

	// 3.1.9: Instructions to Access CSRs
	ACSRRW
	ACSRRS
	ACSRRC
	ACSRRWI
	ACSRRSI
	ACSRRCI

	// 3.2.1: Environment Call and Breakpoint
	AECALL
	ASCALL
	AEBREAK
	ASBREAK

	// 3.2.2: Trap-Return Instructions
	AMRET
	ASRET
	ADRET

	// 3.2.3: Wait for Interrupt
	AWFI

	// 4.2.1: Supervisor Memory-Management Fence Instruction