- - "call-chain"
      - name: unconditional-recursion
      - name: identical-branches
        # the following rules can be enabled in the future
        # - name: empty-lines
        # - name: confusing-results
        # - name: empty-block
        # - name: get-return
        # - name: confusing-naming
        # - name: unexported-naming
        # - name: early-return
        # - name: unused-parameter

}

type instance struct {
	// clients are cached clients for each revision
	clients map[string]kube.CLIClient
	// remoteClients are cached clients for each context with empty revision.
	remoteClients map[string]kube.CLIClient
	RootFlags
}

func newKubeClientWithRevision(kubeconfig, configContext, revision string, impersonateConfig rest.ImpersonationConfig) (kube.CLIClient, error) {

		consErr = append(consErr, err)
	}

	return errors.Join(consErr...)
}

func (s *NetServer) buildZtunnelSnapshot(ambientPodUIDs map[types.UID]*corev1.Pod) error {
	// first add all the pods as empty:
	for uid := range ambientPodUIDs {
		s.currentPodSnapshot.Ensure(string(uid))
	}

	// populate full pod snapshot from cgroups
	return s.scanProcForPodsAndCache(ambientPodUIDs)
}

		if selector.Matches(podsLabels) {
			cfgs = append(cfgs, cfg)
		}
	}

	return cfgs
}

// printConfigs prints the applied configs based on the member's type.
// When there is the array is empty, caller should make sure the intended
// log is handled in their methods.
func printConfigs(writer io.Writer, configs []*config.Config) {
	if len(configs) == 0 {
		return
	}

                    x-kubernetes-validations:
                    - message: wildcard not allowed in label key match
                      rule: self.all(key, !key.contains('*'))
                    - message: key must not be empty
                      rule: self.all(key, key.size() != 0)
                type: object
              sha256:
                description: SHA256 checksum that will be used to verify Wasm module