"golang.org/x/sys/unix"
)

func AddInpodMarkIPRule(cfg *Config) error {
	err := forEachInpodMarkIPRule(cfg, netlink.RuleAdd)
	if errors.Is(err, unix.EEXIST) {
		log.Debugf("Ignoring exists error adding inpod mark ip rule: %v", err)
		return nil
	}
	return err
}

func DelInpodMarkIPRule(cfg *Config) error {
	return forEachInpodMarkIPRule(cfg, netlink.RuleDel)
}

    # always skip the injection on pods that match that label selector, regardless of the global policy.
    # See https://istio.io/docs/setup/kubernetes/additional-setup/sidecar-injection/#more-control-adding-exceptions
    neverInjectSelector: []
    alwaysInjectSelector: []

    # injectedAnnotations are additional annotations that will be added to the pod spec after injection

}

func (c *Controller) labelBrokenPod(pod *corev1.Pod) error {
	// Added for safety, to make sure no healthy pods get labeled.
	m := podsRepaired.With(typeLabel.Value(labelType))
	repairLog.Infof("Pod detected as broken, adding label: %s/%s", pod.Namespace, pod.Name)

	labels := pod.GetLabels()
	if _, ok := labels[c.cfg.LabelKey]; ok {
		m.With(resultLabel.Value(resultSkip)).Increment()

	builder := cfg.appendInpodRules(hostProbeSNAT)

	if err := cfg.addLoopbackRoute(); err != nil {
		return err
	}

	if err := cfg.addInpodMarkIPRule(); err != nil {
		return err
	}

	log.Debug("Adding iptables rules")
	if err := cfg.executeCommands(builder); err != nil {
		log.Errorf("failed to restore iptables rules: %v", err)
		return err
	}

	return nil
}

  // refers to; it MUST be the same name returned by the CSI GetPluginName()
  // call for that driver.
  // The driver name must be 63 characters or less, beginning and ending with
  // an alphanumeric character ([a-z0-9A-Z]) with dashes (-), dots (.), and
  // alphanumerics between.
  // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata

                  allocation for a pool.
                type: boolean
              avoidBuggyIPs:
                default: false
                description: AvoidBuggyIPs prevents addresses ending with .0 and .255
                  to be used by a pool.
                type: boolean
              serviceAllocation:
                description: AllocateTo makes ip pool allocation to specific namespace

  // for each node that meets all of the scheduling requirements (resource
  // request, requiredDuringScheduling affinity expressions, etc.),
  // compute a sum by iterating through the elements of this field and adding
  // "weight" to the sum if the node matches the corresponding matchExpressions; the
  // node(s) with the highest sum are the most preferred.
  // +optional

    # always skip the injection on pods that match that label selector, regardless of the global policy.
    # See https://istio.io/docs/setup/kubernetes/additional-setup/sidecar-injection/#more-control-adding-exceptions
    neverInjectSelector: []
    alwaysInjectSelector: []
    # injectedAnnotations are additional annotations that will be added to the pod spec after injection

	"istio.io/istio/pkg/kube"
	"istio.io/istio/pkg/log"
)

// installerScope is the scope for all commands in the mesh package.
var installerScope = log.RegisterScope("installer", "installer")

func init() {
	// adding to remove message about the controller-runtime logs not getting displayed
	// We cannot do this in the `log` package since it would place a runtime dependency on controller-runtime for all binaries.

1. The `caClient` will be configured to use either JWT or mTLS authentication. For JWT authentication, gRPC's `PerRPCCredentials`
   is configured with a `TokenProvider` which handles the logic of adding the proper JWT to each request. mTLS is configured
   by a tls.Config that points to files on disk.

It should be noted there is a circular dependency with mTLS authentication; in order to fetch a certificate we need