return "", err
			}
		}
	}

	installLog.Infof("CNI config file %s exists. Proceeding.", cniConfigFilepath)

	return cniConfigFilepath, err
}

// Follows the same semantics as kubelet
// https://github.com/kubernetes/kubernetes/blob/954996e231074dc7429f7be1256a579bedd8344c/pkg/kubelet/dockershim/network/cni/cni.go#L144-L184
func getDefaultCNINetwork(confDir string) (string, error) {

# PeerAuthentication Implementation in Ambient

message NetworkPolicyPeer {
  // This is a label selector which selects Pods. This field follows standard label
  // selector semantics; if present but empty, it selects all pods.
  //
  // If NamespaceSelector is also set, then the NetworkPolicyPeer as a whole selects
  // the Pods matching PodSelector in the Namespaces selected by NamespaceSelector.

  * This includes UDP, non-compliant HTTP, server-first protocols, stateful sets, external services, etc.
  * Explicitly opting into behavioral changes can be acceptable. For example, introducing Istio multi-cluster semantics.
* Ensure traffic between mesh workloads is securely encrypted with an Istio identity.
* Be lightweight enough to not limit adoption.

// fields are allowed
message NetworkPolicyPeer {
  // podSelector is a label selector which selects pods. This field follows standard label
  // selector semantics; if present but empty, it selects all pods.
  //
  // If namespaceSelector is also set, then the NetworkPolicyPeer as a whole selects
  // the pods matching podSelector in the Namespaces selected by NamespaceSelector.

				if err != nil {
					return false, nil, err
				}
				// Kubernetes Fake watches do not add initial state, but real server does
				// https://kubernetes.io/docs/reference/using-api/api-concepts/#semantics-for-watch
				// Tracking in https://github.com/kubernetes/kubernetes/issues/123109
				gvk := gvk.MustFromGVR(gvr).Kubernetes()
				objs, err := fc.Tracker().List(gvr, gvk, ns)

  // routing to all endpoints evenly (possibly modified by topology and other
  // features). Note that traffic sent to an External IP or LoadBalancer IP from
  // within the cluster will always get "Cluster" semantics, but clients sending to
  // a NodePort from within the cluster may need to take traffic policy into account
  // when picking a node.
  // +optional
  optional string externalTrafficPolicy = 11;

	})
	if err != nil {
		return err
	}
	// If there is no default webhook but a revisioned default webhook exists,
	// and we are installing a new IOP with default semantics, the default webhook shifts.
	if exists && len(mwhs.Items) == 0 && iop.Spec.GetRevision() == "" {
		p.Println("This installation will make default injection and validation pointing to the default revision, and " +

  // capacity is the value reported by the CSI driver in its GetCapacityResponse
  // for a GetCapacityRequest with topology and parameters that match the
  // previous fields.
  //
  // The semantic is currently (CSI spec 1.2) defined as:
  // The available capacity, in bytes, of the storage that can be used
  // to provision volumes. If not set, that information is currently
  // unavailable.
  //
  // +optional

  // corresponding to changes (subsequent to the RV) to objects watched.
  //
  // When `sendInitialEvents` option is set, we require `resourceVersionMatch`
  // option to also be set. The semantic of the watch request is as following:
  // - `resourceVersionMatch` = NotOlderThan
  //   is interpreted as "data at least as new as the provided `resourceVersion`"
  //   and the bookmark event is send when the state is synced