## Privileges required

	}
	tests := []struct {
		name string
		args args
		want bool
	}{
		{
			name: "ambient mode enabled for namespace",
			args: args{
				namespace: namespaceWithAmbientEnabledLabel,
				pod:       unlabelledPod,
			},
			want: true,
		},
		{
			name: "ambient mode enabled for pod",
			args: args{
				namespace: unlabelledNamespace,
				pod:       podWithAmbientEnabledLabel,
			},

		initialized         = mode&ScanInitialized != 0
		update              = mode&ScanUpdate != 0
		onConflictDonothing = mode&ScanOnConflictDoNothing != 0
	)

	db.RowsAffected = 0

	switch dest := db.Statement.Dest.(type) {
	case map[string]interface{}, *map[string]interface{}:
		if initialized || rows.Next() {
			columnTypes, _ := rows.ColumnTypes()

	// ErrPrimaryKeyRequired primary keys required
	ErrPrimaryKeyRequired = errors.New("primary key required")
	// ErrModelValueRequired model value required
	ErrModelValueRequired = errors.New("model value required")
	// ErrModelAccessibleFieldsRequired model accessible fields required
	ErrModelAccessibleFieldsRequired = errors.New("model accessible fields required")
	// ErrSubQueryRequired sub query required
	ErrSubQueryRequired = errors.New("sub query required")

func (s *xlStorage) openFileSync(filePath string, mode int, skipParent string) (f *os.File, err error) {
	return s.openFile(filePath, mode|writeMode, skipParent)
}

func (s *xlStorage) openFile(filePath string, mode int, skipParent string) (f *os.File, err error) {
	if skipParent == "" {
		skipParent = s.drivePath
	}
	// Create top level directories if they don't exist.
	// with mode 0777 mkdir honors system umask.

	log.Infof("in pod mode - adding pod %s/%s to ztunnel ", pod.Namespace, pod.Name)
	// make sure the cache is aware of the pod, even if we don't have the netns yet.
	s.currentPodSnapshot.Ensure(string(pod.UID))
	openNetns, err := s.getOrOpenNetns(pod, netNs)
	if err != nil {
		return err
	}

	// Handle node healthcheck probe rewrites

	RepairLabelValue         = "repair-broken-pod-label-value"
	RepairNodeName           = "repair-node-name"
	RepairSidecarAnnotation  = "repair-sidecar-annotation"
	RepairInitContainerName  = "repair-init-container-name"
	RepairInitTerminationMsg = "repair-init-container-termination-message"
	RepairInitExitCode       = "repair-init-container-exit-code"
	RepairLabelSelectors     = "repair-label-selectors"

		if cfg.InstallConfig.AmbientEnabled {
			// Start ambient controller

			// node agent will spawn a goroutine and watch the K8S API for events,
			// as well as listen for messages from the CNI binary.
			log.Info("Starting ambient node agent with inpod redirect mode")
			ambientAgent, err := nodeagent.NewServer(ctx, watchServerReady, cfg.InstallConfig.CNIEventAddress,
				nodeagent.AmbientArgs{

    *   Metrics update and collection logic in default `Model.train_step()` is
        now customizable via overriding `Model.compute_metrics()`.
    *   Losses computation logic in default `Model.train_step()` is now
        customizable via overriding `Model.compute_loss()`.
    *   `jit_compile` added to `Model.compile()` on an opt-in basis to compile
        the model's training step with [XLA](https://www.tensorflow.org/xla).

	CNINetworkConfigFile string
	// CNI config template string
	CNINetworkConfig string

	// Logging level
	LogLevel string
	// Name of the kubeconfig file used by the CNI plugin
	KubeconfigFilename string
	// The file mode to set when creating the kubeconfig file
	KubeconfigMode int
	// CA file for kubeconfig
	KubeCAFile string
	// Whether to use insecure TLS in the kubeconfig file
	SkipTLSVerify bool

	// KUBERNETES_SERVICE_PROTOCOL