// Either way, we will skip.
			log.Errorf("Skipping pod, already repaired with an unexpected UID %v vs %v", uid, pod.UID)
		}
		return nil
	}
	log.Infof("Repairing pod...")

	// Fetch the pod's network namespace. This must run in the host process due to how the procfs /ns/net works.
	// This will get a network namespace ID. This ID is scoped to the network namespace we running in.

                                "set_node_on_first_message_only": true,
                                "transport_api_version": "V3"
                              },
                              "initial_fetch_timeout": "0s",
                              "resource_api_version": "V3"
                            }
                          }
                        ],
                        "combined_validation_context": {

            "name": "inbound-vip|8000|http|httpbin.default.svc.cluster.local",
            "type": "EDS",
            "eds_cluster_config": {
              "eds_config": {
                "ads": {},
                "initial_fetch_timeout": "0s",
                "resource_api_version": "V3"
              },
              "service_name": "inbound-vip|8000|http|httpbin.default.svc.cluster.local"
            },
            "transport_socket": {

            "stat_prefix": "outbound_0.0.0.0_9080",
            "rds": {
             "config_source": {
              "ads": {},
              "initial_fetch_timeout": "0s",
              "resource_api_version": "V3"
             },
             "route_config_name": "9080"
            },
            "http_filters": [
             {

) error {
	kubeClient, client, err := KubernetesClients(kubeClient, l)
	if err != nil {
		return err
	}

	tag, err := GetTagVersion(operatorVer.OperatorVersionString)
	if err != nil {
		return fmt.Errorf("fetch Istio version: %v", err)
	}

	// return warning if current date is near the EOL date
	if operatorVer.IsEOL() {
		warnMarker := color.New(color.FgYellow).Add(color.Italic).Sprint("WARNING:")

"spaceLength": 10, "stack": false, "steppedLine": false, "targets": [ { "expr": "avg(envoy_wasm_remote_load_fetch_failures)", "interval": "", "legendFormat": "failures", "refId": "A" }, { "expr": "avg(envoy_wasm_remote_load_fetch_successes)", "interval": "", "legendFormat": "successes", "refId": "B" } ], "thresholds": [], "timeFrom": null, "timeRegions": [], "timeShift": null, "title": "Remote Fetch", "tooltip": { "shared": true, "sort": 0, "value_type": "individual" }, "type": "graph", "xaxis": { "buckets":...

            "type": "EDS",
            "eds_cluster_config": {
              "eds_config": {
                "ads": {},
                "initial_fetch_timeout": "0s",
                "resource_api_version": "V3"
              },
              "service_name": "outbound|9080|v1|productpage.default.svc.cluster.local"
            },
            "connect_timeout": "10s",

* If istio-agent does not find either the socket, or the certificate files in their respective paths it will start its own SDS Server using a `caClient` to connect to istiod or an external CA, to fetch cryptographic materials (See Default CA Flow).

![SDS decision flow](docs/sds-flow.svg)

### Default CA Flow through istio-agent

![CA Flow](docs/ca.svg)

            "name": "inbound-vip|9080|http|ratings.default.svc.cluster.local",
            "type": "EDS",
            "eds_cluster_config": {
              "eds_config": {
                "ads": {},
                "initial_fetch_timeout": "0s",
                "resource_api_version": "V3"
              },
              "service_name": "inbound-vip|9080|http|ratings.default.svc.cluster.local"
            },
            "transport_socket": {

	meshCfg, err := getMeshConfig(kubeClient, istioNamespace)
	if err != nil {
		return fmt.Errorf("failed to fetch mesh config: %v", err)
	}

	workloadPAList, err := configClient.SecurityV1beta1().PeerAuthentications(workloadNamespace).List(context.Background(), metav1.ListOptions{})
	if err != nil {
		return fmt.Errorf("failed to fetch workload namespace PeerAuthentication: %v", err)
	}