should be locked down and restricted.  The new installer allows multiple instances of
policy/control/telemetry - so testing/staging of new settings and versions can be performed
by a different role than the prod version.

The intended users of this repo are users running Istio in production who want to select, tune
and understand each binary that gets deployed, and select which combination to use.

		currentPodCache: map[string]WorkloadInfo{},
	}
}

func (p *podNetnsCache) UpsertPodCache(pod *corev1.Pod, nspath string) (Netns, error) {
	newnetns, err := p.openNetns(nspath)
	if err != nil {
		return nil, err
	}
	wl := WorkloadInfo{
		Workload: podToWorkload(pod),
		Netns:    newnetns,
	}
	return p.UpsertPodCacheWithNetns(string(pod.UID), wl), nil
}

	// This could break on some platforms if they do not have an interface-per-pod.
	wantID, err := findNetworkIDByIP(pod.Status.PodIP)
	if err != nil {
		return "", fmt.Errorf("network id: %v", err)
	}
	fs, err := procfs.NewFS("/host/proc")
	if err != nil {
		return "", fmt.Errorf("read procfs: %v", err)
	}
	procs, err := fs.AllProcs()
	if err != nil {
		return "", fmt.Errorf("read procs: %v", err)
	}

	ConstructInitialSnapshot(ambientPods []*corev1.Pod) error
	Start(ctx context.Context)

	//	IsPodInMesh(ctx context.Context, pod *metav1.ObjectMeta, netNs string) (bool, error)
	AddPodToMesh(ctx context.Context, pod *corev1.Pod, podIPs []netip.Addr, netNs string) error
	RemovePodFromMesh(ctx context.Context, pod *corev1.Pod) error
	DelPodFromMesh(ctx context.Context, pod *corev1.Pod) error

	Stop()
}

type Server struct {

  {{- else }}
    image: "{{ .ProxyImage }}"
  {{- end }}
    ports:
    - containerPort: 15090
      protocol: TCP
      name: http-envoy-prom
    args:
    - proxy
    - router
    - --domain
    - $(POD_NAMESPACE).svc.{{ .Values.global.proxy.clusterDomain }}
    - --proxyLogLevel={{ annotation .ObjectMeta `sidecar.istio.io/logLevel` .Values.global.proxy.logLevel }}

func (f *fakeServer) AddPodToMesh(ctx context.Context, pod *corev1.Pod, podIPs []netip.Addr, netNs string) error {
	if f.testWG != nil {
		defer f.testWG.Done()
	}
	args := f.Called(ctx, pod, podIPs, netNs)
	return args.Error(0)
}

func (f *fakeServer) RemovePodFromMesh(ctx context.Context, pod *corev1.Pod) error {
	if f.testWG != nil {
		defer f.testWG.Done()
	}
	args := f.Called(ctx, pod)
	return args.Error(0)
}

  {{ $prom := include "default-prometheus" . | eq "true" }}
  {{ $sdMetrics := include "default-sd-metrics" . | eq "true" }}
  {{ $sdLogs := include "default-sd-logs" . | eq "true" }}
  {{- if or $prom $sdMetrics $sdLogs }}
    defaultProviders:
    {{- if or $prom $sdMetrics }}
      metrics:
      {{ if $prom }}- prometheus{{ end }}

)

func TestWithProcFs(t *testing.T) {
	n := NewPodNetnsProcFinder(fakeFs())
	pod := &corev1.Pod{ObjectMeta: metav1.ObjectMeta{
		Name:      "foo",
		Namespace: "bar",
		UID:       types.UID("863b91d4-4b68-4efa-917f-4b560e3e86aa"),
	}}
	podUIDNetns, err := n.FindNetnsForPods(map[types.UID]*corev1.Pod{
		pod.UID: pod,
	})
	if err != nil {
		panic(err)
	}
	defer podUIDNetns.Close()

  // in a pod.
  // The runtimeHandler must be lowercase, conform to the DNS Label (RFC 1123)
  // requirements, and is immutable.
  optional string runtimeHandler = 1;

  // overhead represents the resource overhead associated with running a pod for a
  // given RuntimeClass. For more details, see
  // https://git.k8s.io/enhancements/keps/sig-node/688-pod-overhead/README.md
  // +optional

  // in a pod.
  // The Handler must be lowercase, conform to the DNS Label (RFC 1123) requirements,
  // and is immutable.
  optional string handler = 2;

  // overhead represents the resource overhead associated with running a pod for a
  // given RuntimeClass. For more details, see
  //  https://kubernetes.io/docs/concepts/scheduling-eviction/pod-overhead/
  // +optional