file or class name and description of purpose be included on the
      same "printed page" as the copyright notice for easier
      identification within third-party archives.

   Copyright 2016-2017 The New York Times Company

   Licensed under the Apache License, Version 2.0 (the "License");
   you may not use this file except in compliance with the License.
   You may obtain a copy of the License at

If set to true, the user is not prompted and a Yes response is assumed in all cases.`
	filenameFlagHelpStr = `Path to file containing IstioOperator custom resource
This flag can be specified multiple times to overlay multiple files. Multiple files are overlaid in left to right order.`
	installationCompleteStr            = `Installation complete`
	ForceFlagHelpStr                   = `Proceed even with validation errors.`

	var err error

	log.Debugf("Checking pod: %s in ns: %s is enabled for ambient", addCmd.PodName, addCmd.PodNamespace)
	// The plugin already consulted the k8s API - but on this end handler caches may be stale, so retry a few times if we get no pod.
	for ambientPod, err = s.handlers.GetPodIfAmbient(addCmd.PodName, addCmd.PodNamespace); (ambientPod == nil) && (retries < maxStaleRetries); retries++ {
		if err != nil {
			return err
		}

  // fully started (see Started field).
  //
  // The value is typically used to determine whether a container is ready to
  // accept traffic.
  optional bool ready = 4;

  // RestartCount holds the number of times the container has been restarted.
  // Kubelet makes an effort to always increment the value, but there
  // are cases when the state may be lost due to node restarts and then the value

      file or class name and description of purpose be included on the
      same "printed page" as the copyright notice for easier
      identification within third-party archives.

   Copyright 2016-2017 The New York Times Company

   Licensed under the Apache License, Version 2.0 (the "License");
   you may not use this file except in compliance with the License.
   You may obtain a copy of the License at

# determine if a retry should be attempted.
# Example: retry.sh "connection timed out" ./my-flaky-script.sh some args
# This will run "my-flaky-script.sh", retrying any failed runs that output "connection timed out" up
# to 5 times.

function fail {
  echo "${1}" >&2
  exit 1
}

function isatty() {
 if [ -t 1 ] ; then
   return 0
  else
   return 1
  fi
}

function retry {
  local tmpFile

    if k2 in res[k1]:
        del res[k1][k2]


def normalize_configmap(res):
    try:
        if res['kind'] != "ConfigMap":
            return res

        data = res['data']

        # some times keys are yamls...
        # so parse them
        for k in data:
            try:
                op = yaml.safe_load_all(data[k])
                data[k] = list(op)
            except yaml.YAMLError as ex:

  // immediately when the rolling update starts. Once new pods are ready, old ReplicaSet
  // can be scaled down further, followed by scaling up the new ReplicaSet, ensuring
  // that the total number of pods available at all times during the update is at
  // least 70% of desired pods.
  // +optional
  optional k8s.io.apimachinery.pkg.util.intstr.IntOrString maxUnavailable = 1;

far more steps than the Istio installer - but each step is smaller and focused on a specific
feature, and can be performed by different people/teams at different times.

It is strongly recommended that different namespaces are used, with different service accounts.
In particular access to the security-critical production components (root CA, policy, control)

  // and be subject to the failure policy.
  repeated string admissionReviewVersions = 8;

  // reinvocationPolicy indicates whether this webhook should be called multiple times as part of a single admission evaluation.
  // Allowed values are "Never" and "IfNeeded".
  //
  // Never: the webhook will not be called more than once in a single admission evaluation.
  //