return err
	}

	// Once we successfully annotate the pod as fully captured,
	// the informer can no longer retry events, and there's no going back.
	// This should be the last step in all cases - once we do this, the CP (and the informer) will consider
	// this pod "ambient" and successfully enrolled.
	log.Debugf("annotating pod")

	}
	return nil, nil
}

func (s *InformerHandlers) Start() {
	// Wait for all events to be queued
	kube.WaitForCacheSync("informer", s.ctx.Done(), s.pods.HasSynced, s.namespaces.HasSynced)
	go s.queue.Run(s.ctx.Done())
	// Note that we are explicitly *not* doing
	// 'kube.WaitForCacheSync("informer queue", s.ctx.Done(), s.queue.HasSynced)'
	// here, because we cannot successfully process the event queue until a ztunnel connects.
	//

* Proper syncing and shutdown logic. Checking for when an informer has fully started can be quite tricky; `kclient` automatically handles it.

Under the `kclient` package, `clienttest` also provides similar interfaces meant for writing unit tests.

*All Istio informer usage should use this library and not operate on Kubernetes informers directly.*

**`krt`** is a very high level wrapper around Kubernetes informers, building on top of `kclient`.

	// Unfortunately the scenario tested here is inherently racy - once the first AddPodToMesh
	// fails, we annotate with a partial status, and the original event is queued by the informer for retry.
	//
	// However the partial status *also* triggers its own new update event, and given that the informer
	// doesn't "diff" old and new events, we can't tell them apart. This is fine tho, since `Adds` are

	// Start the informer handlers FIRST, before we snapshot.
	// They will keep the (mutex'd) snapshot cache synced.
	s.handlers.Start()
	if err != nil {
		log.Warnf("failed to construct initial snapshot: %v", err)
	}
	// Start accepting ztunnel connections
	// (and send current snapshot when we get one)
	s.dataplane.Start(s.ctx)
	// Everything (informer handlers, snapshot, zt server) ready to go

// See the License for the specific language governing permissions and
// limitations under the License.

package nodeagent

import (
	"errors"
	"fmt"
)

// An error on pod add that the ambient informer should not
// attempt to retry
var ErrNonRetryableAdd = errors.New("pod add cannot be retried")

type NonRetryableAddError struct {
	inner error
}

func (e *NonRetryableAddError) Error() string {

//
// - initializes a an internal cache of pod info and netns handles with these existing pods.
// This cache will also be updated when the K8S informer gets a new pod.
// This cache represents the "state of the world" of all enrolled pods on the node this agent
// knows about, and will be sent to any connecting ztunnel as a startup message.
//

- Extend kube-apiserver /readyz with new "informer-sync" check ensuring that internal informers are synced. ([#92644](https://github.com/kubernetes/kubernetes/pull/92644), [@wojtek-t](https://github.com/wojtek-t)) [SIG API Machinery and Testing]

* NodeController waits for informer sync before doing anything ([#34809](https://github.com/kubernetes/kubernetes/pull/34809), [@gmarek](https://github.com/gmarek))

* Only wait for cache syncs once in NodeController ([#34851](https://github.com/kubernetes/kubernetes/pull/34851), [@ncdc](https://github.com/ncdc))
* NodeController waits for informer sync before doing anything ([#34809](https://github.com/kubernetes/kubernetes/pull/34809), [@gmarek](https://github.com/gmarek))