// behavior is being explicitly overridden, for example when the associated
  // Service has set the publishNotReadyAddresses flag.
  // +optional
  optional bool ready = 1;

  // serving is identical to ready except that it is set regardless of the
  // terminating state of endpoints. This condition should be set to true for
  // a ready endpoint that is terminating. If nil, consumers should defer to
  // the ready condition.

// projected volume as files using the keys in the Data field as the file names,
// unless the items element is populated with specific mappings of keys to paths.
// Note that this is identical to a configmap volume source without the default
// mode.
message ConfigMapProjection {
  optional LocalObjectReference localObjectReference = 1;

* Correctness at startup; with the sequencing above, items are only processed once all informers are synced. This means queries will not return stale data at startup.
* Deduping of identical events
* Automatic retrying of failed events (configurable)

The above logic is critical to handle correctly to ensure correctness of a controller.

      - name: call-to-gc
      - name: duplicated-imports
      - name: string-of-int
      - name: defer
        arguments:
          - - "call-chain"
      - name: unconditional-recursion
      - name: identical-branches
        # the following rules can be enabled in the future
        # - name: empty-lines
        # - name: confusing-results
        # - name: empty-block
        # - name: get-return

  // "{ValidatingAdmissionPolicy name}/{key}".
  //
  // If an admission webhook uses the same resource name as this ValidatingAdmissionPolicy
  // and the same audit annotation key, the annotation key will be identical.
  // In this case, the first annotation written with the key will be included
  // in the audit event and all subsequent annotations with the same key
  // will be discarded.
  //
  // Required.

  // unknown state as ready. For compatibility reasons, ready should never be
  // "true" for terminating endpoints.
  // +optional
  optional bool ready = 1;

  // serving is identical to ready except that it is set regardless of the
  // terminating state of endpoints. This condition should be set to true for
  // a ready endpoint that is terminating. If nil, consumers should defer to
  // the ready condition.

			if rootCA1 == rootCA2 {
				report := fmt.Sprintf("Both [%s.%s] and [%s.%s] have the identical ROOTCA, theoretically the connectivity between them is available",
					podName1, podNamespace1, podName2, podNamespace2)
				c.Println(report)
				returnErr = nil
			} else {
				report := fmt.Sprintf("Both [%s.%s] and [%s.%s] have the non identical ROOTCA, theoretically the connectivity between them is unavailable",

			expectedString: "Profiles are identical",
		},
		{
			args:           fmt.Sprintf("profile diff demo demo --manifests %s", snapshotCharts),
			expectedString: "Profiles are identical",
		},
		{
			args:           fmt.Sprintf("profile diff openshift openshift --manifests %s", snapshotCharts),
			expectedString: "Profiles are identical",
		},
	}

	for i, c := range cases {

		ignoreResources, verbose)
	if err != nil {
		return false, err
	}
	if diff != "" {
		fmt.Printf("Differences in manifests are:\n%s\n", diff)
		return false, nil
	}

	fmt.Println("Manifests are identical")
	return true, nil
}

func yamlFileFilter(path string) bool {
	return filepath.Ext(path) == YAMLSuffix
}

// compareManifestsFromDirs compares manifests from two directories

		// ip rule add fwmark 0x111/0xfff pref 32764 lookup 100
		//
		// Adds in-pod rules for marking packets with the istio-specific TPROXY mark.
		// A very similar mechanism is used for sidecar TPROXY.
		//
		// TODO largely identical/copied from tools/istio-iptables/pkg/capture/run_linux.go
		inpodMarkRule := netlink.NewRule()
		inpodMarkRule.Family = family
		inpodMarkRule.Table = RouteTableInbound
		inpodMarkRule.Mark = InpodTProxyMark