to the Licensor or its representatives, including but not limited to
      communication on electronic mailing lists, source code control systems,
      and issue tracking systems that are managed by, or on behalf of, the
      Licensor for the purpose of discussing and improving the Work, but
      excluding communication that is conspicuously marked or otherwise

      to the Licensor or its representatives, including but not limited to
      communication on electronic mailing lists, source code control systems,
      and issue tracking systems that are managed by, or on behalf of, the
      Licensor for the purpose of discussing and improving the Work, but
      excluding communication that is conspicuously marked or otherwise

func closeNetns(netns NetnsCloser) {
	netns.Close()
}

func (p *podNetnsCache) ReadCurrentPodSnapshot() map[string]WorkloadInfo {
	p.mu.RLock()
	defer p.mu.RUnlock()
	// snapshot the cache to avoid long locking
	return maps.Clone(p.currentPodCache)
}

// Remove and return the Netns for the given uid
// No need to return NetnsCloser here it will be closed automatically on GC.

      to the Licensor or its representatives, including but not limited to
      communication on electronic mailing lists, source code control systems,
      and issue tracking systems that are managed by, or on behalf of, the
      Licensor for the purpose of discussing and improving the Work, but
      excluding communication that is conspicuously marked or otherwise

	pods := s.handlers.GetAmbientPods()
	err := s.dataplane.ConstructInitialSnapshot(pods)
	if err != nil {
		log.Warnf("failed to construct initial snapshot: %v", err)
	}

	log.Info("CNI ambient server marking ready")
	s.Ready()
	s.dataplane.Start(s.ctx)
	s.handlers.Start()
}

func (s *Server) Stop() {
	log.Info("CNI ambient server terminating, cleaning up node net rules")

	s.cniServerStopFunc()

| `Traceparent` | (Experimental) This maintains tracing information. Note this is tracing of *connections*, and is not correlated to tracing of user's own HTTP requests. However, this is useful to follow a connection across ztunnels.                                 |

## Traffic routing

  // `JobPodFailurePolicy` feature gate (disabled by default).
  // +optional
  optional PodFailurePolicy podFailurePolicy = 11;

  // Specifies the number of retries before marking this job failed.
  // Defaults to 6
  // +optional
  optional int32 backoffLimit = 7;

  // A label query over pods that should match the pod count.
  // Normally, the system sets this field for you.

  // More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#resources
  // +optional
  optional ResourceRequirements resources = 2;

  // volumeName is the binding reference to the PersistentVolume backing this claim.
  // +optional
  optional string volumeName = 3;

  // storageClassName is the name of the StorageClass required by the claim.

		versionCount[configVersion] = count + 1
	} else {
		versionCount[configVersion] = 1
	}
}

const distributionTrackingDisabledErrorString = "pilot version tracking is disabled " +
	"(To enable this feature, please set PILOT_ENABLE_CONFIG_DISTRIBUTION_TRACKING=true)"

func poll(ctx cli.Context,
	cmd *cobra.Command,
	acceptedVersions []string,
	targetResource string,
	proxyID string,

#### Caching

Config translation typically takes the overwhelming majority of Istiod's resource usage. In particular, protobuf encoding. As a result, caching has been introduced, storing the already encoded `protobuf.Any` for a given resource.