}
		if kc.ShutdownGracePeriod.Duration < 0 || (kc.ShutdownGracePeriod.Duration > 0 && kc.ShutdownGracePeriod.Duration < time.Second) {
			allErrors = append(allErrors, fmt.Errorf("invalid configuration: shutdownGracePeriod %v must be either zero or otherwise >= 1 sec", kc.ShutdownGracePeriod))
		}

}

func (kc *kubeletConfig) Get() interface{} {
	return &kc.config
}

func (kc *kubeletConfig) Set(cfg interface{}) {
	kc.config = *cfg.(*kubeletconfig.KubeletConfiguration)
}

func (kc *kubeletConfig) Default(cfg *kubeadmapi.ClusterConfiguration, _ *kubeadmapi.APIEndpoint, nodeRegOpts *kubeadmapi.NodeRegistrationOptions) {
	const kind = "KubeletConfiguration"

func KubeletConfigurationPathRefs(kc *KubeletConfiguration) []*string {
	paths := []*string{}
	paths = append(paths, &kc.StaticPodPath)
	paths = append(paths, &kc.Authentication.X509.ClientCAFile)
	paths = append(paths, &kc.TLSCertFile)
	paths = append(paths, &kc.TLSPrivateKeyFile)
	paths = append(paths, &kc.ResolverConfig)
	paths = append(paths, &kc.VolumePluginDir)
	paths = append(paths, &kc.PodLogsDir)
	return paths

func NewStatusSyncer(meshHolder mesh.Watcher, kc kubelib.Client) *StatusSyncer {
	c := &StatusSyncer{
		meshConfig:     meshHolder,
		ingresses:      kclient.NewFiltered[*knetworking.Ingress](kc, kclient.Filter{ObjectFilter: kc.ObjectFilter()}),
		ingressClasses: kclient.New[*knetworking.IngressClass](kc),
		pods: kclient.NewFiltered[*corev1.Pod](kc, kclient.Filter{
			ObjectFilter:    kc.ObjectFilter(),

	"k8s.io/client-go/informers"
	"k8s.io/client-go/kubernetes/fake"
	"k8s.io/client-go/tools/cache"
)

func TestBeforeSynced(t *testing.T) {
	kc := fake.NewSimpleClientset()

	informerFactory := informers.NewSharedInformerFactoryWithOptions(kc, 0)

	ctbInformer := informerFactory.Certificates().V1alpha1().ClusterTrustBundles()
	ctbManager, _ := NewInformerManager(ctbInformer, 256, 5*time.Minute)

func InitializeTLS(kf *options.KubeletFlags, kc *kubeletconfiginternal.KubeletConfiguration) (*server.TLSOptions, error) {
	if !kc.ServerTLSBootstrap && kc.TLSCertFile == "" && kc.TLSPrivateKeyFile == "" {
		kc.TLSCertFile = filepath.Join(kf.CertDirectory, "kubelet.crt")
		kc.TLSPrivateKeyFile = filepath.Join(kf.CertDirectory, "kubelet.key")

		canReadCertAndKey, err := certutil.CanReadCertAndKey(kc.TLSCertFile, kc.TLSPrivateKeyFile)

func maybeWriteKubeConfigFile(cfg *config.InstallConfig) error {
	kc, err := createKubeConfig(cfg)
	if err != nil {
		return err
	}

	if err := checkExistingKubeConfigFile(cfg, kc); err != nil {
		installLog.Info("kubeconfig either does not exist or is out of date, writing a new one")

			var objs []runtime.Object
			if tc.existingConfigMap != nil {
				objs = []runtime.Object{tc.existingConfigMap}
			}
			kc := kube.NewFakeClient(objs...)
			fake := kc.Kube().(*fake.Clientset)
			configmaps := kclient.New[*v1.ConfigMap](kc)
			if tc.clientMod != nil {
				tc.clientMod(fake)
			}
			kc.RunAndWait(test.NewStop(t))
			fake.ClearActions()
			err := InsertDataToConfigMap(configmaps, tc.meta, tc.caBundle)

	"k8s.io/utils/ptr"

	"k8s.io/kubernetes/cmd/kubeadm/app/util/initsystem"
)

// Mutate allows applying pre-defined modifications to the config before it's marshaled.
func (kc *kubeletConfig) Mutate() error {
	if err := mutateResolverConfig(&kc.config, isServiceActive); err != nil {
		return err
	}
	return nil
}

// mutateResolverConfig mutates the ResolverConfig in the kubeletConfig dynamically.

	})
	return gatewayError
}

func TestGreenfield(t *testing.T) {
	controllerStop := make(chan struct{})
	clientStop := test.NewStop(t)
	kc := kube.NewFakeClient()
	gatewayError := setupGatewayError(kc)
	c := unstartedTestController(kc)
	kc.RunAndWait(clientStop)
	go c.Run(controllerStop)
	webhooks := clienttest.Wrap(t, c.webhooks)
	fetch := func(name string) func() *admission.ValidatingWebhookConfiguration {