},
		}

		for _, route := range netlinkRoutes {
			log.Debugf("Iterating netlink route : %+v", route)
			if err := f(route); err != nil {
				log.Errorf("Failed to add netlink route : %+v", route)
				return fmt.Errorf("failed to add route: %v", err)
			}
		}
	}
	return nil

	} else if err != nil {
		return fmt.Errorf("failed to get namespace %s: %v", ns, err)
	}
	if nsObj.Labels == nil {
		nsObj.Labels = map[string]string{}
	}
	nsObj.Labels[constants.AmbientUseWaypointLabel] = waypointName
	if _, err := kubeClient.Kube().CoreV1().Namespaces().Update(context.Background(), nsObj, metav1.UpdateOptions{}); err != nil {
		return fmt.Errorf("failed to update namespace %s: %v", ns, err)
	}
	return nil

      break
    fi
    if ! grep -Eq "${failureRegex}" "${tmpFile}"; then
      fail "Unexpected failure"
    fi
    if [[ $n -lt $max ]]; then
      ((n++))
      echo "Command failed. Attempt $n/$max:"
    else
      fail "The command has failed after $n attempts."
    fi
  done
}

			webhookConfig, err := tagWebhookConfigFromCanonicalWebhook(tc.webhook, "default", tc.istioNamespace)
			if err != nil {
				t.Fatalf("webhook parsing failed with error: %v", err)
			}
			webhookConfig, err = fixWhConfig(fakeClient, webhookConfig)
			if err != nil {
				t.Fatalf("webhook fixing failed with error: %v", err)
			}
			opts := &GenerateOptions{
				ManifestsPath: filepath.Join(env.IstioSrc, "manifests"),
			}

	if err != nil {
		return fmt.Errorf("failed to retrieve tag with name %s: %v", tagName, err)
	}
	if len(webhooks) == 0 {
		return fmt.Errorf("cannot remove tag %q: cannot find MutatingWebhookConfiguration for tag", tagName)
	}

	taggedNamespaces, err := GetNamespacesWithTag(ctx, kubeClient, tagName)
	if err != nil {
		return fmt.Errorf("failed to retrieve namespaces dependent on tag %q", tagName)
	}

		if err != nil {
			return nil, fmt.Errorf("failed building warming secret %s: %v",
				warmingSecret.Name, err)
		}
		proxySecretItems = append(proxySecretItems, secret)
	}
	for _, activeSecret := range secretConfigDump.DynamicActiveSecrets {
		secret, err := parseDynamicSecret(activeSecret, "ACTIVE")
		if err != nil {
			return nil, fmt.Errorf("failed building warming secret %s: %v",
				activeSecret.Name, err)

		[]byte(patchBytes), metav1.PatchOptions{}, "status")
	if err != nil {
		repairLog.Errorf("Failed to update pod: %s", err)
		c.events.Write(pod, corev1.EventTypeWarning, ReasonLabelBrokenPod, "pod detected as broken, but failed to label: %v", err)
		m.With(resultLabel.Value(resultFail)).Increment()
		return err
	}

	systemRoots, err := x509.SystemCertPool()
	if err != nil {
		return nil, fmt.Errorf("failed to get system cert pool: %w", err)
	}
	gcpCreds, err := oauth.NewApplicationDefault(ctx)
	if err != nil {
		return nil, fmt.Errorf("failed to get application default credentials: %w", err)
	}

	return []grpc.DialOption{
		grpc.WithTransportCredentials(credentials.NewTLS(&tls.Config{

	f := filepath.Join(t.TempDir(), "test")
	l, err := NewListener(f)
	if err != nil {
		t.Fatalf("unexpected error %v", err)
	}
	defer l.Close()
	conn, err := connect(f)
	if err != nil {
		t.Fatalf("failed to connect %v", err)
	}
	conn.Close()
}

func connect(socket string) (*grpc.ClientConn, error) {
	var opts []grpc.DialOption

}

message CertificateSigningRequestCondition {
  // type of the condition. Known conditions include "Approved", "Denied", and "Failed".
  optional string type = 1;

  // Status of the condition, one of True, False, Unknown.
  // Approved, Denied, and Failed conditions may not be "False" or "Unknown".
  // Defaults to "True".
  // If unset, should be treated as "True".
  // +optional
  optional string status = 6;