{ set +x; } 2>/dev/null
  # Throughout, "local" usage is critical to avoid nested calls overwriting things
  local start
  start="$(date -u +%s.%N)"
  # First, get a trace and span ID. We need to get one now so we can propagate it to the child
  # Get trace ID from TRACEPARENT, if present
  local tid
  tid="$(<<<"${TRACEPARENT:-}" cut -d- -f2)"
  tid="${tid:-"$(tr -dc 'a-f0-9' < /dev/urandom | head -c 32)"}"

func (z *ZtunnelConnection) sendDataAndWaitForAck(data []byte, fd *int) (*zdsapi.WorkloadResponse, error) {
	var rights []byte
	if fd != nil {
		rights = unix.UnixRights(*fd)
	}
	err := z.u.SetWriteDeadline(time.Now().Add(readWriteDeadline))
	if err != nil {
		return nil, err
	}

	_, _, err = z.u.WriteMsgUnix(data, rights, nil)
	if err != nil {
		return nil, err
	}

	// wait for ack

			Name:      "foo",
			Namespace: "bar",
			UID:       "123",
		},
		Spec: corev1.PodSpec{ServiceAccountName: "sa"},
	}

	// this is usually called after add. so manually add the pod uid for now
	fakens := newFakeNs(123)
	closed := fakens.closed
	workload := WorkloadInfo{
		Workload: podToWorkload(pod),
		Netns:    fakens,
	}
	fixture.podNsMap.UpsertPodCacheWithNetns(string(pod.UID), workload)

  // unset or false and it can be flipped later when storage
  // capacity information has been published.
  //
  // This field was immutable in Kubernetes <= 1.22 and now is mutable.
  //
  // +optional
  // +featureGate=CSIStorageCapacity
  optional bool storageCapacity = 4;

  // fsGroupPolicy defines if the underlying volume supports changing ownership and

		panic(err)
	}
	err = c.SetWriteDeadline(time.Now().Add(time.Second))
	if err != nil {
		panic(err)
	}
	c.Write(data)
}

func sendHello(c *net.UnixConn) {
	ack := &zdsapi.ZdsHello{
		Version: zdsapi.Version_V1,
	}
	data, err := proto.Marshal(ack)
	if err != nil {
		panic(err)
	}
	err = c.SetWriteDeadline(time.Now().Add(time.Second))
	if err != nil {
		panic(err)
	}

						VersionInfo: "2023-06-20T09:07:41Z/3",
						Listener: &anypb.Any{
							TypeUrl: "type.googleapis.com/envoy.config.listener.v3.Listener",
						},
						LastUpdated: timestamppb.Now(),
					},
					ClientStatus: 453,
				},
			},
		},
	}
	tests := []struct {
		name  string
		input *envoy_admin.ListenersConfigDump_DynamicListener
	}{
		{
			name: "Test2",

  // NodePhase is the recently observed lifecycle phase of the node.
  // More info: https://kubernetes.io/docs/concepts/nodes/node/#phase
  // The field is never populated, and now is deprecated.
  // +optional
  optional string phase = 3;

  // Conditions is an array of current observed node conditions.
  // More info: https://kubernetes.io/docs/concepts/nodes/node/#condition

}

func certNotExpired(cert *Cert) bool {
	// case where cert state is in either Initializing or Unavailable state
	if cert.ExpirationTime == "" && cert.ValidFrom == "" {
		return false
	}
	today := time.Now()
	expDate, err := time.Parse(time.RFC3339, cert.ExpirationTime)
	if err != nil {
		log.Errorf("certificate timestamp (%v) could not be parsed: %v", cert.ExpirationTime, err)
		return false
	}

func (s *NetServer) RemovePodFromMesh(ctx context.Context, pod *corev1.Pod) error {
	log := log.WithLabels("ns", pod.Namespace, "name", pod.Name)
	log.Debugf("Pod is now opt out... cleaning up.")

	openNetns := s.currentPodSnapshot.Take(string(pod.UID))
	if openNetns == nil {
		log.Warn("failed to find pod netns")
		return fmt.Errorf("failed to find pod netns")
	}

			res := ObjectToInstance(se)
			messages.Add(msg.NewUpdateIncompatibility(res,
				"ENABLE_RESOLUTION_NONE_TARGET_PORT", "1.21",
				"ServiceEntry with resolution NONE and a targetPort set previously did nothing but now is respected", "1.21"))
		}
	}
	return nil
}

func checkExternalNameAlias(cli kube.CLIClient, messages *diag.Messages) error {