client kubernetes.Interface

	namespaceLister listers.NamespaceLister
	namespaceSynced cache.InformerSynced

	systemNamespaces []string
	interval         time.Duration
}

// NewController creates a new Controller to ensure system namespaces exist.
func NewController(systemNamespaces []string, clientset kubernetes.Interface, namespaceInformer coreinformers.NamespaceInformer) *Controller {
	interval := 1 * time.Minute

			for _, obj := range objs {
				namespaceInformer.Informer().GetIndexer().Add(obj)
			}

			systemNamespaces := []string{metav1.NamespaceSystem, metav1.NamespacePublic, v1.NamespaceNodeLease, metav1.NamespaceDefault}
			controller := NewController(systemNamespaces, clientset, namespaceInformer)

			clientset.PrependReactor("create", "namespaces", func(action k8stesting.Action) (bool, runtime.Object, error) {

	if err != nil {
		return nil, err
	}
	if len(c.SystemNamespaces) > 0 {
		s.GenericAPIServer.AddPostStartHookOrDie("start-system-namespaces-controller", func(hookContext genericapiserver.PostStartHookContext) error {
			go systemnamespaces.NewController(c.SystemNamespaces, client, s.VersionedInformers.Core().V1().Namespaces()).Run(hookContext.StopCh)
			return nil
		})
	}

				},
				HTTPTimeout: time.Duration(5) * time.Second,
			},
			ServiceNodePortRange: kubeoptions.DefaultServiceNodePortRange,
			MasterCount:          1,
		},
	}

	s.Options.SystemNamespaces = append(s.Options.SystemNamespaces, v1.NamespaceNodeLease)

	return &s
}

// Flags returns flags for a specific APIServer by section name
func (s *ServerRunOptions) Flags() (fss cliflag.NamedFlagSets) {

			StorageFactory:          storageFactory,
			EventTTL:                opts.EventTTL,
			EnableLogsSupport:       opts.EnableLogsHandler,
			ProxyTransport:          proxyTransport,
			SystemNamespaces:        opts.SystemNamespaces,

			ServiceAccountIssuer:        opts.ServiceAccountIssuer,
			ServiceAccountMaxExpiration: opts.ServiceAccountTokenMaxExpiration,

	ServiceAccountSigningKeyFile     string
	ServiceAccountIssuer             serviceaccount.TokenGenerator
	ServiceAccountTokenMaxExpiration time.Duration

	ShowHiddenMetricsForVersion string

	SystemNamespaces []string
}

// completedServerRunOptions is a private wrapper that enforces a call of Complete() before Run can be invoked.
type completedOptions struct {
	Options
}

type CompletedOptions struct {

		Logs:                    logs.NewOptions(),
		Traces: &apiserveroptions.TracingOptions{
			ConfigFile: "/var/run/kubernetes/tracing_config.yaml",
		},
		AggregatorRejectForwardingRedirects: true,
		SystemNamespaces:                    []string{"kube-system", "kube-public", "default"},
	}

	expected.Authentication.OIDC.UsernameClaim = "sub"
	expected.Authentication.OIDC.SigningAlgs = []string{"RS256"}

			Logs:                    logs.NewOptions(),
			Traces: &apiserveroptions.TracingOptions{
				ConfigFile: "/var/run/kubernetes/tracing_config.yaml",
			},
			AggregatorRejectForwardingRedirects: true,
			SystemNamespaces:                    []string{"kube-system", "kube-public", "default", "kube-node-lease"},
		},

		Extra: Extra{
			ServiceNodePortRange:   kubeoptions.DefaultServiceNodePortRange,

subjectAltName=@san
[ san ]
DNS.1 = istiod.{{ .SystemNamespace }}
DNS.2 = istiod.{{ .SystemNamespace }}.svc
DNS.3 = istio-pilot.{{ .SystemNamespace }}
DNS.4 = istio-pilot.{{ .SystemNamespace }}.svc
[ req_dn ]
O = Istio
CN = Intermediate CA
`
)

// NewIstioConfig creates an extensions configuration for Istio, using the given system namespace in
// the DNS SANs.
func NewIstioConfig(systemNamespace string) (string, error) {

		"tag=" + s.Image.Tag,
		"values.global.imagePullPolicy=" + s.Image.PullPolicy,
		"values.gateways.istio-ingressgateway.autoscaleEnabled=false",
	}

	if i.cfg.SystemNamespace != "istio-system" {
		setArgs = append(setArgs, "values.global.istioNamespace="+i.cfg.SystemNamespace)
	}

	// Include all user-specified values.
	for k, v := range i.cfg.Values {
		setArgs = append(setArgs, fmt.Sprintf("values.%s=%s", k, v))
	}