// Returns a storage rest client.
func newStorageRESTClient(endpoint Endpoint, healthCheck bool, gm *grid.Manager) (*storageRESTClient, error) {
	serverURL := &url.URL{
		Scheme: endpoint.Scheme,
		Host:   endpoint.Host,
		Path:   path.Join(storageRESTPrefix, endpoint.Path, storageRESTVersion),
	}

	restClient := rest.NewClient(serverURL, globalInternodeTransport, newCachedAuthToken())

	if healthCheck {

	// within all pods as we do on the host.
	//
	// This should be fine, as the host binaries are all we have to work with here anyway,
	// as we are running within a privileged container - and we don't want to take the time to
	// redetect for each pod anyway.
	//
	// Extreme corner case:
	// If for some reason your host had both binaries, and you were injecting out-of-band

	path := "logging"
	if param != "" {
		path = path + "?" + param
	}
	// "Envoy" applies despite this being ztunnel
	result, err := kubeClient.EnvoyDoWithPort(context.TODO(), podName, podNamespace, "POST", path, port)
	if err != nil {
		return "", fmt.Errorf("failed to execute command on Ztunnel: %v", err)
	}
	return string(result), nil
}

		// Windows can lock up with this optimization, so we fall back to regular copy.
		sr, ok := rc.(*sendFileReader)
		if ok {
			// Sendfile sends in 4MiB chunks per sendfile syscall which is more than enough
			// for most setups.
			_, err = rf.ReadFrom(sr.Reader)
			if !xnet.IsNetworkOrHostDown(err, true) { // do not need to log disconnected clients
				storageLogIf(r.Context(), err)
			}

	}

	return di, err
}

// Implements stringer compatible interface.
func (s *xlStorage) String() string {
	return s.drivePath
}

func (s *xlStorage) Hostname() string {
	return s.endpoint.Host
}

func (s *xlStorage) Endpoint() Endpoint {
	return s.endpoint
}

func (*xlStorage) Close() error {
	return nil
}

func (s *xlStorage) IsOnline() bool {
	return true
}

	HostProbeSNATIPV6 = netip.MustParseAddr(env.RegisterStringVar("HOST_PROBE_SNAT_IPV6", DefaultHostProbeSNATIPV6, "").Get())
)

const (
	// to reliably identify kubelet healthprobes from inside the pod (versus standard kube-proxy traffic,
	// since the IP is normally the same), we SNAT identified host probes in the host netns to a fixed
	// APIPA/"link-local" IP.

		Title:   "Istio CNI Plugin Installer",
		Section: "install-cni CLI",
		Manual:  "Istio CNI Plugin Installer",
	}))

	registerStringParameter(constants.CNINetDir, "/etc/cni/net.d", "Directory on the host where CNI network plugins are installed")
	registerStringParameter(constants.CNIConfName, "", "Name of the CNI configuration file")

	if bucket == minioMetaBucket {
		return false
	}
	switch {
	// Check if we have a read quorum issue
	case errors.Is(err, errErasureReadQuorum):
		return true
	// Check if the object is inexistent in most disks but not all of them
	case errors.Is(err, errFileNotFound) || errors.Is(err, errFileVersionNotFound):
		for i := range errs {
			if errs[i] == nil {
				return true
			}
		}
	}
	return false
}

// Exposed for testing constants
var (
	CNIBinDir          = "/opt/cni/bin"
	HostCNIBinDir      = "/host/opt/cni/bin"
	ServiceAccountPath = "/var/run/secrets/kubernetes.io/serviceaccount"
	// Well-known subpath we will mount any needed host-mounts under,
	// to preclude shadowing or breaking any pod-internal mounts
	HostMountsPath = "/host"

	go s.ztunnelServer.Run(ctx)
}

func (s *NetServer) Stop() {
	log.Debug("removing host iptables rules")
	s.iptablesConfigurator.DeleteHostRules()

	log.Debug("destroying host ipset")
	s.hostsideProbeIPSet.Flush()
	if err := s.hostsideProbeIPSet.DestroySet(); err != nil {
		log.Warnf("could not destroy host ipset on shutdown")
	}
	log.Debug("stopping ztunnel server")
	s.ztunnelServer.Close()
}