return
	}
	messages := make([]cniLog, 0, len(cniLogs))
	for _, l := range cniLogs {
		var msg cniLog
		if err := json.Unmarshal([]byte(l), &msg); err != nil {
			log.Debugf("Failed to unmarshal CNI plugin log entry: %v", err)
			continue
		}
		msg.Msg = strings.TrimSpace(msg.Msg)
		messages = append(messages, msg)
	}
	// Lock log message printing to prevent log messages from different CNI
	// processes interleave.

	if cfg.chainedCNIPlugin {
		if !file.Exists(cniConfigFilepath) {
			return "", fmt.Errorf("CNI config file %s removed during configuration", cniConfigFilepath)
		}
		// This section overwrites an existing plugins list entry for istio-cni
		existingCNIConfig, err := os.ReadFile(cniConfigFilepath)
		if err != nil {
			return "", err
		}
		cniConfig, err = insertCNIConfig(cniConfig, existingCNIConfig)
		if err != nil {

  optional PodSignature podSignature = 1;

  // Time at which this entry was added to the list.
  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.Time evictionTime = 2;

  // (brief) reason why this entry was added to the list.
  // +optional
  optional string reason = 3;

  // Human readable message indicating why this entry was added to the list.
  // +optional
  optional string message = 4;
}

# See the License for the specific language governing permissions and
# limitations under the License.

# retry.sh retries a command until it succeeds. It accepts a regex pattern to match failures on to
# determine if a retry should be attempted.
# Example: retry.sh "connection timed out" ./my-flaky-script.sh some args
# This will run "my-flaky-script.sh", retrying any failed runs that output "connection timed out" up

	res, err := netlink.IpsetList(name)
	if err != nil {
		return fmt.Errorf("failed to list ipset %s: %w", name, err)
	}
	for _, entry := range res.Entries {
		if entry.Comment == comment {
			err := netlink.IpsetDel(name, &entry)
			if err != nil {
				return fmt.Errorf("failed to delete IP %s from ipset %s: %w", entry.IP, name, err)
			}
		}
	}
	return nil
}

  // "*" matches all verbs and, if present, must be the only entry.
  // +listType=set
  // Required.
  repeated string verbs = 1;

  // `apiGroups` is a list of matching API groups and may not be empty.
  // "*" matches all API groups and, if present, must be the only entry.
  // +listType=set
  // Required.
  repeated string apiGroups = 2;

  // "*" matches all verbs and, if present, must be the only entry.
  // +listType=set
  // Required.
  repeated string verbs = 1;

  // `apiGroups` is a list of matching API groups and may not be empty.
  // "*" matches all API groups and, if present, must be the only entry.
  // +listType=set
  // Required.
  repeated string apiGroups = 2;

			args:              strings.Split("entry configure --name foo -o temp --clusterID cid", " "),
			expectedException: true,
			expectedOutput:    "Error: expecting a WorkloadGroup artifact file or the name and namespace of an existing WorkloadGroup\n",
		},
		{
			description:       "Invalid command args - missing valid input spec",
			args:              strings.Split("entry configure -n bar -o temp --clusterID cid", " "),

  repeated HTTPIngressPath paths = 1;
}

// IPBlock describes a particular CIDR (Ex. "192.168.1.0/24","2001:db8::/64") that is allowed
// to the pods matched by a NetworkPolicySpec's podSelector. The except entry describes CIDRs
// that should not be included within this rule.
message IPBlock {
  // cidr is a string representing the IPBlock
  // Valid examples are "192.168.1.0/24" or "2001:db8::/64"
  optional string cidr = 1;

  // If all API server instances agree on the same encoding storage version,
  // then this field is set to that version. Otherwise this field is left empty.
  // API servers should finish updating its storageVersionStatus entry before
  // serving write operations, so that this field will be in sync with the reality.
  // +optional
  optional string commonEncodingVersion = 2;

  // The latest available observations of the storageVersion's state.