log("dsync: Unable to call Refresh failed with %s for %#v at %s\n", err, args, c)
			} else {
				ch <- refreshResult{refreshed: refreshed}
				log("dsync: Refresh returned false for %#v at %s\n", args, c)
			}
		}(index, c)
	}

	// Wait until we have either
	//
	// a) received all refresh responses
	// b) received too many refreshed for quorum to be still possible
	// c) timed out
	//

				"cert-chain-alt-2.pem", "root-cert-alt.pem"); err != nil {
				t.Errorf("failed to update CA secret: %v", err)
			}

			// perform one retry to handle race condition where ztunnel cert is refreshed before Istiod certificates are reloaded
			retry.UntilSuccess(func() error {
				newWorkloadCert := waitForWorkloadCertUpdate(t, ztunnelPod, sa, istioCtl, originalWorkloadSecret)

		if ok, err := r.order.Advance(&bc.ev, r.gen.evTable, bc.m, r.gen.gen); !ok || err != nil {
			return ok, err
		}

		// Refresh the cursor's event.
		ok, err := bc.nextEvent(r.gen.batches[bc.m], r.gen.freq)
		if err != nil {
			return false, err
		}
		if ok {
			// If we successfully refreshed, update the heap.
			heapUpdate(r.frontier, i)
		} else {
			// There's nothing else to read. Delete this cursor from the frontier.

  repeated APIResourceDiscovery resources = 2;

  // freshness marks whether a group version's discovery document is up to date.
  // "Current" indicates the discovery document was recently
  // refreshed. "Stale" indicates the discovery document could not
  // be retrieved and the returned discovery document may be
  // significantly out of date. Clients that require the latest

	// freshness marks whether a group version's discovery document is up to date.
	// "Current" indicates the discovery document was recently
	// refreshed. "Stale" indicates the discovery document could not
	// be retrieved and the returned discovery document may be
	// significantly out of date. Clients that require the latest

		SELinuxRelabel: true,
	}
}

// SetUp puts in place the volume plugin.
// This function is not idempotent by design. We want the data to be refreshed periodically.
// The internal sync interval of kubelet will drive the refresh of data.
// TODO: Add volume specific ticker and refresh loop
func (b *downwardAPIVolumeMounter) SetUp(mounterArgs volume.MounterArgs) error {
	return b.SetUpAt(b.GetPath(), mounterArgs)
}

        return verificationMode;
    }

    /**
     * Sets the key refresh flag.
     *
     * @param refresh If set to true, missing keys will be checked again. By default missing keys are cached for 24 hours.
     * @since 6.2
     */
    public void setRefreshKeys(boolean refresh) {
        refreshKeys = refresh;
    }

    /**
     * If true, Gradle will try to download missing keys again.

  repeated APIResourceDiscovery resources = 2;

  // freshness marks whether a group version's discovery document is up to date.
  // "Current" indicates the discovery document was recently
  // refreshed. "Stale" indicates the discovery document could not
  // be retrieved and the returned discovery document may be
  // significantly out of date. Clients that require the latest

  repeated APIResourceDiscovery resources = 2;

  // freshness marks whether a group version's discovery document is up to date.
  // "Current" indicates the discovery document was recently
  // refreshed. "Stale" indicates the discovery document could not
  // be retrieved and the returned discovery document may be
  // significantly out of date. Clients that require the latest

	}

	mclaims := jwtgo.MapClaims(claims)
	jwtToken, err := jp.ParseWithClaims(token, &mclaims, keyFuncCallback)
	if err != nil {
		// Re-populate the public key in-case the JWKS
		// pubkeys are refreshed
		if err = r.PopulatePublicKey(arn); err != nil {
			return err
		}
		jwtToken, err = jwtgo.ParseWithClaims(token, &mclaims, keyFuncCallback)
		if err != nil {
			return err
		}
	}