//
		// Adds in-pod rules for marking packets with the istio-specific TPROXY mark.
		// A very similar mechanism is used for sidecar TPROXY.
		//
		// TODO largely identical/copied from tools/istio-iptables/pkg/capture/run_linux.go
		inpodMarkRule := netlink.NewRule()
		inpodMarkRule.Family = family
		inpodMarkRule.Table = RouteTableInbound
		inpodMarkRule.Mark = InpodTProxyMark

	}

	expectedUID := "863b91d4-4b68-4efa-917f-4b560e3e86aa"
	if podUIDNetns[expectedUID] == (WorkloadInfo{}) {
		t.Fatal("expected to find pod netns under pod uid")
	}
}

// copied and modified from spire

func TestGetContainerIDFromCGroups(t *testing.T) {
	makeCGroups := func(groupPaths []string) []Cgroup {
		var out []Cgroup
		for _, groupPath := range groupPaths {
			out = append(out, Cgroup{

# However, it has a bunch of LICENSE test files that our linter fails to understand
- helm.sh/helm/v3

# https://github.com/pelletier/go-toml/blob/master/LICENSE
# Uses MIT for everything, except a few files copied from
# google's civil library that uses Apache 2
- github.com/pelletier/go-toml

# https://github.com/xeipuuv/gojsonpointer/blob/master/LICENSE-APACHE-2.0.txt
- github.com/xeipuuv/gojsonpointer

message ResourceClaimTemplateSpec {
  // ObjectMeta may contain labels and annotations that will be copied into the PVC
  // when creating it. No other fields are allowed and will be rejected during
  // validation.
  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;

  // Spec for the ResourceClaim. The entire content is copied unchanged
  // into the ResourceClaim that gets created from this template. The

- `istio-cni`
    - CNI plugin executable copied to `/opt/cni/bin`
    - currently implemented for k8s only
    - on pod add, determines whether pod should have netns setup to redirect to Istio proxy. See [cmdAdd](#cmdadd-workflow) for detailed logic.

	// KUBERNETES_SERVICE_HOST
	K8sServiceHost string
	// KUBERNETES_SERVICE_PORT
	K8sServicePort string
	// KUBERNETES_NODE_NAME
	K8sNodeName string

	// Directory from where the CNI binaries should be copied
	CNIBinSourceDir string
	// Directories into which to copy the CNI binaries
	CNIBinTargetDirs []string

	// The HTTP port for monitoring
	MonitoringPort int

}

// AdmissionResponse describes an admission response.
message AdmissionResponse {
  // UID is an identifier for the individual request/response.
  // This should be copied over from the corresponding AdmissionRequest.
  optional string uid = 1;

  // Allowed indicates whether or not the admission request was permitted.
  optional bool allowed = 2;

package install

import (
	"os"
	"path/filepath"

	"istio.io/istio/pkg/file"
	"istio.io/istio/pkg/util/sets"
)

// Copies/mirrors any files present in a single source dir to N number of target dirs
// and returns a set of the filenames copied.
func copyBinaries(srcDir string, targetDirs []string) (sets.String, error) {
	copiedFilenames := sets.String{}
	srcFiles, err := os.ReadDir(srcDir)
	if err != nil {

}

// AdmissionResponse describes an admission response.
message AdmissionResponse {
  // UID is an identifier for the individual request/response.
  // This must be copied over from the corresponding AdmissionRequest.
  optional string uid = 1;

  // Allowed indicates whether or not the admission request was permitted.
  optional bool allowed = 2;

Install for a remote cluster using an external control plane.

The templates in this directory are copies of base and istio-discovery templates.