- apiGroups: ["discovery.k8s.io"]
    resources: ["endpointslices"]
    verbs: ["get", "list", "watch"]
  - apiGroups: ["{{ $mcsAPIGroup }}"]
    resources: ["serviceexports"]
    verbs: ["get", "list", "watch", "create", "delete"]
  - apiGroups: ["{{ $mcsAPIGroup }}"]
    resources: ["serviceimports"]
    verbs: ["get", "list", "watch"]
  - apiGroups: ["apps"]
    resources: ["replicasets"]
    verbs: ["get", "list", "watch"]

	}

	dal := make([]*admin.ListenersConfigDump_DynamicListener, 0)
	for _, l := range listenerDump.DynamicListeners {
		// If a listener was reloaded, it would contain both the active and draining state
		// delete the draining state for proper comparison
		l.DrainingState = nil
		if l.ActiveState != nil {
			dal = append(dal, l)
		}
	}

	// Support v2 or v3 in config dump. See ads.go:RequestedTypes for more info.

	if err != nil {
		return err
	}
	var result error
	for _, wh := range webhooks {
		result = multierror.Append(result, client.AdmissionregistrationV1().MutatingWebhookConfigurations().Delete(ctx, wh.Name, metav1.DeleteOptions{})).ErrorOrNil()
	}
	return result
}

// PreviousInstallExists checks whether there is an existing Istio installation. Should be used in installer when deciding

	NodeName string

	// Key and value for broken pod label
	LabelKey   string
	LabelValue string

	// Whether to fix race condition by repairing them
	RepairPods bool

	// Whether to fix race condition by delete broken pods
	DeletePods bool

	// Whether to label broken pods
	LabelPods bool

	// Filters for race repair, including name of sidecar annotation, name of init container,

  // Object is the object from the incoming request.
  // +optional
  optional k8s.io.apimachinery.pkg.runtime.RawExtension object = 9;

  // OldObject is the existing object. Only populated for DELETE and UPDATE requests.
  // +optional
  optional k8s.io.apimachinery.pkg.runtime.RawExtension oldObject = 10;

  // DryRun indicates that modifications will definitely not be persisted for this request.

rules:
  - apiGroups: ["apps"]
    verbs: [ "get", "watch", "list", "update", "patch", "create", "delete" ]
    resources: [ "deployments" ]
  - apiGroups: [""]
    verbs: [ "get", "watch", "list", "update", "patch", "create", "delete" ]
    resources: [ "services" ]
  - apiGroups: [""]
    verbs: [ "get", "watch", "list", "update", "patch", "create", "delete" ]
    resources: [ "serviceaccounts"]

	err := netlink.IpsetDel(name, &netlink.IPSetEntry{
		IP:       net.IP(ip.AsSlice()),
		Protocol: &ipProto,
	})
	if err != nil {
		return fmt.Errorf("failed to delete IP %s with and proto %d from ipset %s: %w", ip, ipProto, name, err)
	}
	return nil
}

func (m *realDeps) flush(name string) error {
	err := netlink.IpsetFlush(name)
	if err != nil {

	}
	return err
}

// Delete pod from mesh: pod is deleted. iptables rules will die with it, we just need to update ztunnel
func (s *meshDataplane) DelPodFromMesh(ctx context.Context, pod *corev1.Pod) error {
	log := log.WithLabels("ns", pod.Namespace, "name", pod.Name)
	err := s.netServer.DelPodFromMesh(ctx, pod)
	if err != nil {
		log.Errorf("failed to delete pod from mesh: %v", err)
		return err
	}

## Installing the Chart

To install the chart:

```console
helm install ztunnel istio/ztunnel
```

## Uninstalling the Chart

To uninstall/delete the chart:

```console
helm delete ztunnel
```

## Configuration

To view support configuration options and documentation, run:

```console
helm show values istio/ztunnel
```

### Profiles

func (p *podNetnsCache) Take(uid string) Netns {
	// lock current pod map
	p.mu.Lock()
	defer p.mu.Unlock()
	if ns, ok := p.currentPodCache[uid]; ok {
		delete(p.currentPodCache, uid)
		// already in cache
		return ns.Netns
	}

	return nil
}

func openNetnsInRoot(hostMountsPath string) func(nspath string) (NetnsCloser, error) {