// This may be extended in the future if we require larger or smaller quantities.
//
// When a Quantity is parsed from a string, it will remember the type of suffix
// it had, and will use the same type again when it is serialized.
//
// Before serializing, Quantity will be put in "canonical form".
// This means that Exponent/suffix will be adjusted up or down (with a
// corresponding increase or decrease in Mantissa) such that:
//

	if err != nil {
		l.LogAndFatal(err)
	}
	if oiArgs.common.revision == "default" {
		oiArgs.common.revision = ""
	}
	// Error here likely indicates Deployment is missing. If some other K8s error, we will hit it again later.
	already, _ := isControllerInstalled(kubeClient.Kube(), oiArgs.common.operatorNamespace, oiArgs.common.revision)
	if already {

	we may need to ztunnel to send its (uid, bootid / boot time) to us
	so that we can remove stale entries when the ztunnel pod is deleted
	or when the ztunnel pod is restarted in the same pod (remove old entries when the same uid connects again, but with different boot id?)

	save a queue of what needs to be sent to the ztunnel pod and send it one by one when it connects.

	when a new ztunnel connects with different uid, only propagate deletes to older ztunnels.
*/

		{"-t", iptablesconstants.NAT, "-D", iptablesconstants.POSTROUTING, "-j", ChainHostPostrouting},
		// flush-then-delete our created chains
		// these sometimes fail due to "Device or resource busy" - again NBD.
		{"-t", iptablesconstants.NAT, "-F", ChainHostPostrouting},
		{"-t", iptablesconstants.NAT, "-X", ChainHostPostrouting},
	}

	// iptablei seems like a reasonable pluralization of iptables

  // Initialized as false, becomes true after startupProbe is considered
  // successful. Resets to false when the container is restarted, or if kubelet
  // loses state temporarily. In both cases, startup probes will run again.
  // Is always true when no startupProbe is defined and container is running and
  // has passed the postStart lifecycle hook. The null value must be treated the
  // same as false.
  // +optional

	log.Debugf("netns: %s", addCmd.Netns)

	// The CNI node plugin should have already checked the pod against the k8s API before forwarding us the event,
	// but we have to invoke the K8S client anyway, so to be safe we check it again here to make sure we get the same result.
	maxStaleRetries := 10
	msInterval := 10
	retries := 0
	var ambientPod *corev1.Pod
	var err error

  // must be positive integer. If a Job is suspended (at creation or through an
  // update), this timer will effectively be stopped and reset when the Job is
  // resumed again.
  // +optional
  optional int64 activeDeadlineSeconds = 3;

  // Specifies the policy of handling failed pods. In particular, it allows to
  // specify the set of actions and conditions which need to be

  // Note:
  // * the number of additional invocations is not guaranteed to be exactly one.
  // * if additional invocations result in further modifications to the object, webhooks are not guaranteed to be invoked again.
  // * webhooks that use this option may be reordered to minimize the number of additional invocations.
  // * to validate an object after all mutations are guaranteed complete, use a validating admission webhook instead.
  //

default, as the Istio sidecar injector is only run # once. For example, an OPA sidecar injected after the Istio sidecar will not have it's liveness/readiness probes rewritten. # Setting this to `IfNeeded` will result in the sidecar injector being run again if additional mutations occur. reinvocationPolicy: Never rewriteAppHTTPProbe: true # Templates defines a set of custom injection templates that can be used. For example, defining: # # templates: # hello: | # metadata: # labels: # hello: world # # Then...

// switch back to it. This is a hack but it is meant to cover a corner case where a user wants to migrate from a non-revisioned
// old version and then later decides to switch back to the old revision again.
func DeactivateIstioInjectionWebhook(ctx context.Context, client kubernetes.Interface) error {
	whs, err := GetWebhooksWithRevision(ctx, client, DefaultRevisionName)
	if err != nil {
		return err
	}