// Deprecated: Use serviceAccountName instead.
  // +k8s:conversion-gen=false
  // +optional
  optional string serviceAccount = 9;

  // NodeName is a request to schedule this carp onto a specific node. If it is non-empty,
  // the scheduler simply schedules this carp onto that node, assuming that it fits resource
  // requirements.
  // +optional
  optional string nodeName = 10;

//
// They are consumed by the kube-scheduler when a CSI driver opts into
// capacity-aware scheduling with CSIDriverSpec.StorageCapacity. The scheduler
// compares the MaximumVolumeSize against the requested size of pending volumes
// to filter out unsuitable nodes. If MaximumVolumeSize is unset, it falls back
// to a comparison against the less precise Capacity. If that is also unset,

  // scheduled right away as preemption victims receive their graceful termination periods.
  // This field does not guarantee that the pod will be scheduled on this node. Scheduler may decide
  // to place the pod elsewhere if other nodes become available sooner. Scheduler may also decide to

//
// They are consumed by the kube-scheduler when a CSI driver opts into
// capacity-aware scheduling with CSIDriverSpec.StorageCapacity. The scheduler
// compares the MaximumVolumeSize against the requested size of pending volumes
// to filter out unsuitable nodes. If MaximumVolumeSize is unset, it falls back
// to a comparison against the less precise Capacity. If that is also unset,

//
// They are consumed by the kube-scheduler when a CSI driver opts into
// capacity-aware scheduling with CSIDriverSpec.StorageCapacity. The scheduler
// compares the MaximumVolumeSize against the requested size of pending volumes
// to filter out unsuitable nodes. If MaximumVolumeSize is unset, it falls back
// to a comparison against the less precise Capacity. If that is also unset,

  //
  // +listType=atomic
  // +optional
  repeated ResourceHandle resourceHandles = 1;

  // This field will get set by the resource driver after it has allocated
  // the resource to inform the scheduler where it can schedule Pods using
  // the ResourceClaim.
  //
  // Setting this field is optional. If null, the resource is available
  // everywhere.
  // +optional
  optional k8s.io.api.core.v1.NodeSelector availableOnNodes = 2;

	err := netServer.syncHostIPSets([]*corev1.Pod{pod})
	assert.NoError(t, err)
	fakeIPSetDeps.AssertExpectations(t)
}

// for tests that call `runtime.GC()` - we have no control over when the GC is actually scheduled,
// and it is flake-prone to check for closure after calling it, this retries for a bit to make
// sure the netns is closed eventually.
func assertNSClosed(t *testing.T, closed *atomic.Bool) {
	for i := 0; i < 5; i++ {

    # scheduled to a particular nodes with matching taints. Each component can overwrite
    # these default values by adding its tolerations block in the relevant section below
    # and setting the desired values.
    # Configure this field in case that all pods of Istio control plane are expected to
    # be scheduled to particular nodes with specified taints.
    defaultTolerations: []

    # scheduled to a particular nodes with matching taints. Each component can overwrite
    # these default values by adding its tolerations block in the relevant section below
    # and setting the desired values.
    # Configure this field in case that all pods of Istio control plane are expected to
    # be scheduled to particular nodes with specified taints.
    defaultTolerations: []

      nodeSelector:
        kubernetes.io/os: linux
      # Can be configured to allow for excluding istio-cni from being scheduled on specified nodes
      {{- with .Values.cni.affinity }}
      affinity:
        {{- toYaml . | nindent 8 }}
      {{- end }}
      tolerations:
        # Make sure istio-cni-node gets scheduled on all nodes.
        - effect: NoSchedule
          operator: Exists