istioctl ps --xds-address istio.example.com:15012 --cert-dir ~/.istio-certs

  # Retrieve proxy status information via XDS from specific control plane in multi-control plane in-cluster configuration
  # (Select a specific control plane in an in-cluster canary Istio configuration.)
  istioctl ps --xds-label istio.io/rev=default
`,
		Aliases: []string{"ps"},

	)

	for dID, ps := range info.PeerStates {
		if lastUpdate.IsZero() {
			lastUpdate = ps.UpdatedAt
			latestID = dID
			latestPeers = ps.Peers
		}
		if ps.UpdatedAt.After(lastUpdate) {
			lastUpdate = ps.UpdatedAt
			latestID = dID
			latestPeers = ps.Peers
		}
	}
	latestPeerName = info.Sites[latestID].Name

	for dID, ps := range info.PeerStates {

	z.rebalMu.Lock()
	defer z.rebalMu.Unlock()

	ps := z.rebalMeta.PoolStats[poolIdx]
	if ps == nil {
		return
	}

	for i, b := range ps.Buckets {
		if b == bucket {
			ps.Buckets = append(ps.Buckets[:i], ps.Buckets[i+1:]...)
			ps.RebalancedBuckets = append(ps.RebalancedBuckets, bucket)
			break
		}
	}
}

func (r *rebalanceMeta) load(ctx context.Context, store objectIO) error {

		qs.Nodes = append(qs.Nodes, bs.QueueStats.Nodes...)
	}
	qs.Uptime = UTCNow().Unix() - globalBootTime.Unix()

	var ps ProxyMetric
	for _, bs := range bucketStats {
		ps.add(bs.ProxyStats)
	}
	bs = BucketStats{
		ReplicationStats: s,
		QueueStats:       qs,
		ProxyStats:       ps,
	}
	r.mostRecentStatsMu.Lock()
	if len(r.mostRecentStats.Stats) == 0 {

			return true
		}

		if !usersSet.IsEmpty() && !usersSet.Contains(user) {
			return true
		}

		ps := mappedPolicy.toSlice()
		sort.Strings(ps)
		r = append(r, madmin.UserPolicyEntities{
			User:     user,
			Policies: ps,
		})
		return true
	})

	stsMap := xsync.NewMapOf[string, MappedPolicy]()
	for _, user := range users {

	totalSubs := atomic.AddInt32(&ps.numSubscribers, 1)
	if ps.maxSubscribers > 0 && totalSubs > ps.maxSubscribers {
		atomic.AddInt32(&ps.numSubscribers, -1)
		return fmt.Errorf("the limit of `%d` subscribers is reached", ps.maxSubscribers)
	}
	ps.Lock()
	defer ps.Unlock()

	sub := &Sub[T]{ch: subCh, types: Mask(mask.Mask()), filter: filter}
	ps.subs = append(ps.subs, sub)

	// We hold a lock, so we are safe to update

		totalBytesToRebal := float64(ps.InitCapacity)*meta.PercentFreeGoal - float64(ps.InitFreeSpace)
		elapsed := time.Since(ps.Info.StartTime)
		eta := time.Duration(totalBytesToRebal * float64(elapsed) / float64(ps.Bytes))
		if !ps.Info.EndTime.IsZero() {
			stopTime = ps.Info.EndTime
		}

		if !stopTime.IsZero() { // rebalance is stopped or completed
			elapsed = stopTime.Sub(ps.Info.StartTime)
			eta = 0
		}

	Decommission *PoolDecommissionInfo `json:"decommissionInfo,omitempty" msg:"dec"`
}

// Clone returns a copy of PoolStatus
func (ps PoolStatus) Clone() PoolStatus {
	return PoolStatus{
		ID:           ps.ID,
		CmdLine:      ps.CmdLine,
		LastUpdate:   ps.LastUpdate,
		Decommission: ps.Decommission.Clone(),
	}
}

//go:generate msgp -file $GOFILE -unexported
type poolMeta struct {
	Version int          `msg:"v"`

func Parse(arnStr string) (arn ARN, err error) {
	ps := strings.Split(arnStr, ":")
	if len(ps) != 6 || ps[0] != string(arnPrefixArn) {
		err = errors.New("invalid ARN string format")
		return
	}

	if ps[1] != string(arnPartitionMinio) {
		err = errors.New("invalid ARN - bad partition field")
		return
	}

	if ps[2] != string(arnServiceIAM) {
		err = errors.New("invalid ARN - bad service field")

	ps.Lock()
	defer ps.Unlock()

	if len(ps.subs) != 2 || ps.NumSubscribers(MaskAll) != 2 || ps.Subscribers() != 2 {
		t.Fatalf("expected 2 subscribers")
	}
}

func TestNumSubscribersMask(t *testing.T) {
	ps := New[Maskable, Mask](2)
	ch1 := make(chan Maskable, 1)
	ch2 := make(chan Maskable, 1)
	doneCh := make(chan struct{})
	defer close(doneCh)
	if err := ps.Subscribe(Mask(1), ch1, doneCh, nil); err != nil {