}

	p.addToCacheUnderLock(uid, workload)
	return workload.Netns
}

// Update the cache with the given uid and nspath. Return the Netns for the given uid.
// If uid is already present, a cached Netns is returned, and the given nspath is ignored.
func (p *podNetnsCache) Get(uid string) Netns {
	// lock current snapshot pod map
	p.mu.RLock()
	defer p.mu.RUnlock()
	if info, f := p.currentPodCache[uid]; f {

	if _, ok := annotationRegistry[name]; !ok {
		return false, "", fmt.Errorf("no registered annotation with name=%s", name)
	}
	// use annotation value if present
	if val, found := annotations[annotationRegistry[name].key]; found {
		if err := annotationRegistry[name].validator(val); err != nil {
			return true, annotationRegistry[name].defaultVal, err
		}
		return true, val, nil

	return cmd
}

func printCheckInjectorResults(writer io.Writer, was []webhookAnalysis) error {
	if len(was) == 0 {
		fmt.Fprintf(writer, "ERROR: no Istio injection hooks present.\n")
		return nil
	}
	w := table.NewStyleWriter(writer)
	w.SetAddRowFunc(func(obj interface{}) table.Row {
		wa := obj.(webhookAnalysis)
		row := table.Row{
			Cells: make([]table.Cell, 0),
		}

	if err != nil {
		t.Fatalf("expected no error: %+v", err)
	}
	err = checkExistingKubeConfigFile(cfg, expectedKC)

	if err == nil {
		t.Fatalf("expected error, no kubeconfig present")
	}
}

func TestCheckMismatchedExistingKubeConfig(t *testing.T) {
	tmp := t.TempDir()
	os.WriteFile(filepath.Join(tmp, "token"), []byte(saToken), 0o644)
	constants.ServiceAccountPath = tmp

			log.Debugf("Failed to unmarshal CNI plugin log entry: %v", err)
			continue
		}
		msg.Msg = strings.TrimSpace(msg.Msg)
		messages = append(messages, msg)
	}
	// Lock log message printing to prevent log messages from different CNI
	// processes interleave.
	l.mu.Lock()
	defer l.mu.Unlock()
	for _, m := range messages {
		// There is no fatal log from CNI plugin
		switch m.Level {
		case "debug":

	iptablesBuilder.AppendRule(
		iptableslog.UndefinedCommand, ChainInpodOutput, iptablesconstants.NAT,
		"-d", hostProbeSNAT.String(),
		"-p", "tcp",
		"-m", "tcp",
		"-j", "ACCEPT",
	)

	// prevent intercept traffic from app ==> app by pod ip
	iptablesBuilder.AppendVersionedRule("127.0.0.1/32", "::1/128",
		iptableslog.UndefinedCommand, ChainInpodPrerouting, iptablesconstants.MANGLE,

			return nil, fmt.Errorf("cannot parse proto message: %v", err)
		}
		if err = checkFields(un); err != nil {
			return nil, err
		}

		// If object to validate has no namespace, set it (the validity of a CR
		// may depend on its namespace; for example a VirtualService with exportTo=".")
		if obj.Namespace == "" {
			// If the user didn't specify --namespace, and is validating a CR with no namespace, use "default"
			if defaultNamespace == "" {

	if err != nil {
		return err
	}
	for k, v := range ret {
		if !strings.EqualFold(k, "authorization") {
			if _, ok := dst[k]; ok {
				return fmt.Errorf("underlying %s credentials contain a %s header which is already present in the combined credentials", kind, k)
			}
			dst[k] = v
		} else {
			dst[dstHdr] = v
		}
	}
	return nil
}

type hubMembership struct {
	WorkloadIdentityPool string
}

	s.state = state
	return s
}

// Build takes the set fields from the builder and constructs the actual SecretItem
// including generating the SecretMeta from the supplied cert data, if present
func (s *secretItemBuilder) Build() (SecretItem, error) {
	result := SecretItem{
		Name:        s.name,
		Data:        s.data,
		Source:      s.source,
		Destination: s.dest,
		State:       s.state,
	}

				// because tickers won't run immediately
				present, notpresent, sdcnum, err := poll(cliCtx, cmd, generations, targetResource, proxyFlag, opts)
				printVerbosef(cmd, "Received poll result: %d/%d", present, present+notpresent)
				if err != nil {
					return err
				} else if float32(present)/float32(present+notpresent) >= threshold {
					_, _ = fmt.Fprintf(cmd.OutOrStdout(), "Resource %s present on %d out of %d configurations across %d sidecars\n",