if err != nil {
		return nil, err
	}

	log.Debugf("found iptables binary: %+v", iptVer)

	configurator.iptV = iptVer

	ipt6Ver, err := ext.DetectIptablesVersion(true)
	if err != nil {
		return nil, err
	}

	log.Debugf("found iptables v6 binary: %+v", iptVer)

	configurator.ipt6V = ipt6Ver

	return configurator, nil
}

	installer := install.NewInstaller(&serverConfig.InstallConfig, readyFlag)

	t.Logf("CNI installer created, watching...")
	// installer.Run() will block indefinitely, and attempt to permanently "keep"
	// the CNI binary installed.
	if err := installer.Run(ctx); err != nil {
		if errors.Is(err, context.Canceled) || errors.Is(err, context.DeadlineExceeded) {
			// Error was caused by interrupt/termination signal

	// Watch our specific binaries, in each configured binary dir.
	// We may or may not be the only CNI plugin in play, and if we are not
	// we shouldn't fire events for binaries that are not ours.
	var binPaths []string
	for _, bindir := range in.cfg.CNIBinTargetDirs {
		for _, binary := range installedBinFiles.UnsortedList() {
			binPaths = append(binPaths, filepath.Join(bindir, binary))
		}
	}
	targets := append(
		binPaths,

			if err := file.AtomicCopy(filepath.Join("testdata", c.existingConfigFilename), cniNetDir, c.configFilename); err != nil {
				t.Fatal(err)
			}

			// Create existing binary files
			if err := os.WriteFile(filepath.Join(cniBinDir, "istio-cni"), []byte{1, 2, 3}, 0o755); err != nil {
				t.Fatal(err)
			}

			// Create kubeconfig

	return f.full.OpenAPIV3Client()
}

var _ util.Factory = Factory{}

// MakeKubeFactory turns a partial kubetl factory from CLIClient into a full util.Factory
// This is done under istioctl/ to avoid excessive binary bloat in other packages; this pulls in around 10mb of
// dependencies.
var MakeKubeFactory = func(k kube.CLIClient) util.Factory {
	kf := k.UtilFactory()
	return Factory{
		PartialFactory: kf,

		if cfg.InstallConfig.AmbientEnabled {
			// Start ambient controller

			// node agent will spawn a goroutine and watch the K8S API for events,
			// as well as listen for messages from the CNI binary.
			log.Info("Starting ambient node agent with inpod redirect mode")
			ambientAgent, err := nodeagent.NewServer(ctx, watchServerReady, cfg.InstallConfig.CNIEventAddress,
				nodeagent.AmbientArgs{

	remoteSecret, warn, err := createRemoteSecret(opt, client)
	if err != nil {
		return "", warn, err
	}

	// convert any binary data to the string equivalent for easier review. The
	// kube-apiserver will convert this to binary before it persists it to storage.
	remoteSecret.StringData = make(map[string]string, len(remoteSecret.Data))
	for k, v := range remoteSecret.Data {