if err != nil {
		return fmt.Errorf("failed to update node %v after adding taint: %v", node.Name, err)
	}
	log.Debugf("removed readiness taint from node %v", node.Name)
	return nil
}

// deleteTaint removes all the taints that have the same key and effect to given taintToDelete.
func deleteTaint(taints []v1.Taint) []v1.Taint {
	newTaints := []v1.Taint{}
	for i := range taints {
		if taints[i].Key == TaintName {
			continue

		var taints []corev1.Taint
		for _, taint := range node.Spec.Taints {
			if taint.Key == "cni.istio.io/not-ready" {
				continue
			}
			taints = append(taints, taint)
		}
		if len(taints) != len(node.Spec.Taints) {
			node.Spec.Taints = taints
			_, err := nodeC.Update(context.TODO(), &node, metav1.UpdateOptions{})
			if err != nil {
				panic(err)
			}
		}
	}

			taintNodes(ctx)

			// make sure all nodes were untainted
			retry.UntilSuccessOrFail(t, func() error {
				nodeC := ctx.Clusters().Default().Kube().CoreV1().Nodes()
				nodes, err := nodeC.List(ctx.Context(), metav1.ListOptions{})
				if err != nil {
					return err
				}

				for _, node := range nodes.Items {
					for _, taint := range node.Spec.Taints {
						if taint.Key == "cni.istio.io/not-ready" {

    env: {}
    
    # Settings related to the untaint controller
    # This controller will remove `cni.istio.io/not-ready` from nodes when the istio-cni pod becomes ready
    # It should be noted that cluster operator/owner is responsible for having the taint set by their infrastructure provider when new nodes are added to the cluster; the untaint controller does not taint nodes
    taint:
      # Controls whether or not the untaint controller is active

    env: {}
    # Settings related to the untaint controller
    # This controller will remove `cni.istio.io/not-ready` from nodes when the istio-cni pod becomes ready
    # It should be noted that cluster operator/owner is responsible for having the taint set by their infrastructure provider when new nodes are added to the cluster; the untaint controller does not taint nodes
    taint:
      # Controls whether or not the untaint controller is active

}

func (s *nodeTainterTestServer) addTaintedNodes(t *testing.T, nodes ...string) {
	t.Helper()
	for _, node := range nodes {
		node := generateNode(node, nil)
		// add our special taint
		node.Spec.Taints = append(node.Spec.Taints, corev1.Taint{
			Key:    TaintName,
			Value:  "true",
			Effect: corev1.TaintEffectNoSchedule,
		})
		s.nc.Create(node)
	}
}

	// * Other types use "prioritized leader election", which isn't implemented for Lease
	GatewayDeploymentController = "istio-gateway-deployment"
	NodeUntaintController       = "istio-node-untaint"
)

// Leader election key prefix for remote istiod managed clusters
const remoteIstiodPrefix = "^"

type LeaderElection struct {
	namespace string
	name      string
	runFns    []func(stop <-chan struct{})

  done
  echo "Verified that all Windows nodes have status Ready"
}

function untaint_windows_nodes {
  # Untaint the windows nodes to allow test workloads without tolerations to be
  # scheduled onto them.
  WINDOWS_NODES=$(${kubectl} get nodes -l kubernetes.io/os=windows -o name)
  for node in $WINDOWS_NODES; do
    ${kubectl} taint node "$node" node.kubernetes.io/os:NoSchedule-
  done
}

function check_no_system_pods_on_windows_nodes {

	"google.golang.org/grpc/reflection"
	corev1 "k8s.io/api/core/v1"
	"k8s.io/client-go/rest"

	meshconfig "istio.io/api/mesh/v1alpha1"
	"istio.io/api/security/v1beta1"
	"istio.io/istio/pilot/pkg/controllers/untaint"
	kubecredentials "istio.io/istio/pilot/pkg/credentials/kube"
	"istio.io/istio/pilot/pkg/features"
	istiogrpc "istio.io/istio/pilot/pkg/grpc"
	"istio.io/istio/pilot/pkg/keycertbundle"

  CNIUsageConfig cni = 55;

  PilotTaintControllerConfig taint = 57;

  // If set, `istiod` will allow connections from trusted node proxy ztunnels
  // in the provided namespace.
  string trustedZtunnelNamespace = 59;
}

message PilotTaintControllerConfig {
  // Enable the untaint controller for new nodes. This aims to solve a race for CNI installation on