// The data must consist only of PEM certificate blocks that parse as valid
  // X.509 certificates.  Each certificate must include a basic constraints
  // extension with the CA bit set.  The API server will reject objects that
  // contain duplicate certificates, or that use PEM block headers.
  //
  // Users of ClusterTrustBundles, including Kubelet, are free to reorder and
  // deduplicate certificate blocks in this file according to their own logic,

  //
  // Validation requirements:
  //  1. certificate must contain one or more PEM blocks.
  //  2. All PEM blocks must have the "CERTIFICATE" label, contain no headers, and the encoded data
  //   must be a BER-encoded ASN.1 Certificate structure as described in section 4 of RFC5280.
  //  3. Non-PEM content may appear before or after the "CERTIFICATE" PEM blocks and is unvalidated,

all
rule 'MD002', :level => 1
rule 'MD007', :indent => 4
rule 'MD013', :line_length => 160, :code_blocks => false, :tables => false
rule 'MD026', :punctuation => ".,;:!"
exclude_rule 'MD013'
exclude_rule 'MD014'
exclude_rule 'MD030'
exclude_rule 'MD032'
exclude_rule 'MD033'
exclude_rule 'MD041'

			installLog.Infof("Removing binary: %s", istioCNIBin)
			if err := os.Remove(istioCNIBin); err != nil {
				return err
			}
		}
	}
	return nil
}

// sleepWatchInstall blocks until any file change for the binaries or config are detected.
// At that point, the func yields so the caller can recheck the validity of the install.
// If an error occurs or context is canceled, the function will return an error.

	}

	return secret, nil
}

func secretMetaFromCert(rawCert []byte) (SecretMeta, error) {
	block, _ := pem.Decode(rawCert)
	if block == nil {
		return SecretMeta{}, fmt.Errorf("failed to parse certificate PEM")
	}
	cert, err := x509.ParseCertificate(block.Bytes)
	if err != nil {
		return SecretMeta{}, err
	}
	var certType string
	if cert.IsCA {
		certType = "CA"
	} else {

## Privileges required

    # Horizontal Pod Autoscaler will be able to function (if set).
    # Each component can overwrite these default values by adding its own resources
    # block in the relevant section below and setting the desired resources values.
    defaultResources:
      requests:
        cpu: 10m
      #   memory: 128Mi
      # limits:
      #   cpu: 100m
      #   memory: 128Mi

                          source:
                            description: Source specifies the source of a request.
                            properties:
                              ipBlocks:
                                description: Optional.
                                items:
                                  type: string
                                type: array

// until the action is complete, unless the container process fails, in which case the handler is aborted.
message Lifecycle {
  // PostStart is called immediately after a container is created. If the handler fails,
  // the container is terminated and restarted according to its restart policy.
  // Other management of the container blocks until the hook completes.

  // driver can be mounted separately with different `-o context` options. This is
  // typical for storage backends that provide volumes as filesystems on block
  // devices or as independent shared volumes.
  // Kubernetes will call NodeStage / NodePublish with "-o context=xyz" mount
  // option when mounting a ReadWriteOncePod volume used in Pod that has