apiserver_envelope_encryption_kms_operations_latency_seconds_bucket{grpc_status_code="OK",method_name="/v2alpha1.KeyManagementService/Encrypt",provider_name="providerName",le="0.0002"} 0
			apiserver_envelope_encryption_kms_operations_latency_seconds_bucket{grpc_status_code="OK",method_name="/v2alpha1.KeyManagementService/Encrypt",provider_name="providerName",le="0.0004"} 0

}

func RecordDekSourceCacheSize(providerName string, size int) {
	DekSourceCacheSize.WithLabelValues(providerName).Set(float64(size))
}

// RecordKMSOperationLatency records the latency of KMS operation.
func RecordKMSOperationLatency(providerName, methodName string, duration time.Duration, err error) {
	KMSOperationsLatencyMetric.WithLabelValues(providerName, methodName, getErrorCode(err)).Observe(duration.Seconds())
}

	// SHA-256 is used to prevent collisions
	hashPool        *sync.Pool
	providerName    string
	mu              sync.Mutex                          // guards call to set
	recordCacheSize func(providerName string, size int) // for unit tests
}

func newSimpleCache(clock clock.Clock, ttl time.Duration, providerName string) *simpleCache {
	cache := utilcache.NewExpiringWithClock(clock)

														{
															RequiresType: &envoy_jwt.JwtRequirement_ProviderName{
																ProviderName: "origins-0",
															},
														},
														{
															RequiresType: &envoy_jwt.JwtRequirement_ProviderName{
																ProviderName: "origins-1",
															},
														},
														{

	cache := newSimpleCache(fakeClock, 5*time.Second, "panda")
	var record sync.Map
	var cacheSize atomic.Uint64
	cache.recordCacheSize = func(providerName string, size int) {
		if providerName != "panda" {
			t.Errorf(`expected "panda" as provider name, got %q`, providerName)
		}
		if _, loaded := record.LoadOrStore(size, nil); loaded {
			t.Errorf("detected duplicated cache size metric for %d", size)
		}

func NewEnvelopeTransformer(envelopeService kmsservice.Service, providerName string, stateFunc StateFunc, apiServerID string) value.Transformer {
	return newEnvelopeTransformerWithClock(envelopeService, providerName, stateFunc, apiServerID, cacheTTL, clock.RealClock{})
}

}

func recordMetricsInterceptor(providerName string) grpc.UnaryClientInterceptor {
	return func(ctx context.Context, method string, req, reply interface{}, cc *grpc.ClientConn, invoker grpc.UnaryInvoker, opts ...grpc.CallOption) error {
		start := NowFunc()
		respErr := invoker(ctx, method, req, reply, cc, opts...)
		elapsed := NowFunc().Sub(start)
		metrics.RecordKMSOperationLatency(providerName, method, elapsed, respErr)
		return respErr

	var maxTagLength uint32
	var providerConfig typedConfigGenFn
	var providerName string
	if proxy.XdsNode != nil {
		serviceCluster = proxy.XdsNode.Cluster
	}
	switch provider := providerCfg.Provider.(type) {
	case *meshconfig.MeshConfig_ExtensionProvider_Zipkin:
		maxTagLength = provider.Zipkin.GetMaxTagLength()
		providerName = envoyZipkin
		providerConfig = func() (*anypb.Any, error) {

	mock "k8s.io/apiserver/pkg/storage/value/encrypt/envelope/testing/v2"
	"k8s.io/component-base/metrics/testutil"
	kmsservice "k8s.io/kms/pkg/service"
)

const (
	testProviderName = "providerName"
)

type testSocket struct {
	path     string
	endpoint string
}

// newEndpoint constructs a unique name for a Linux Abstract Socket to be used in a test.

	}
	var providers []string
	for _, service := range services {
		if len(service) > 0 {
			providers = append(providers, "'"+service+"'")
		}
	}
	if len(providers) > 0 {
		psCmd += fmt.Sprintf("; ProviderName=%s", strings.Join(providers, ","))
	}
	psCmd += "}"
	if n.TailLines != nil {
		psCmd += fmt.Sprintf(" -MaxEvents %d", *n.TailLines)
	}
	psCmd += " | Sort-Object TimeCreated"
	if len(n.Pattern) > 0 {