// WebhookCertPatcher listens for webhooks on specified revision and patches their CA bundles
type WebhookCertPatcher struct {
	// revision to patch webhooks for
	revision    string
	webhookName string

	queue controllers.Queue

	// File path to the x509 certificate bundle used by the webhook server
	// and patched into the webhook config.
	CABundleWatcher *keycertbundle.Watcher

	webhooks kclient.Client[*v1.MutatingWebhookConfiguration]

            # Port 5353 is forwarded to kube-dns
            - port: 5353
              name: tcp-dns
          overlays:
            - kind: Deployment
              name: ilb-gateway
              patches:
                - path: spec.template.spec.containers.[name:istio-proxy].env.[name:PILOT_CERT_PROVIDER].value

if you've tripped over a bug.

## Contributing code

Please read the
[Contribution Guidelines](https://golang.org/doc/contribute.html) before sending
patches.

Unless otherwise noted, the Go source files are distributed under the BSD-style

# See the License for the specific language governing permissions and
# limitations under the License.
# ==============================================================================
#
# Given an RPM spec file $1, apply its patches.

SPEC="$1"
grep '%patch' "${SPEC}" |while read cmd ; do
  N=$(echo "${cmd}" |sed 's,%patch\([0-9]\+\).*,\1,')
  file=$(grep "Patch$N:" "${SPEC}" |sed 's,.*: ,,')
  parg=$(echo "${cmd}" |sed 's,.*\(-p[0-9]\).*,\1,')

	result := make([]*core.TypedExtensionConfig, 0)
	if efw == nil {
		return result
	}
	hasName := sets.New(names...)
	for _, p := range efw.Patches[networking.EnvoyFilter_EXTENSION_CONFIG] {
		if p.Operation != networking.EnvoyFilter_Patch_ADD {
			continue
		}
		ec, ok := p.Value.(*core.TypedExtensionConfig)
		if !ok {

			TTL:    &metav1.Duration{Duration: 1234},
		},
	}
	obj.SkipPhases = nil
	obj.NodeRegistration.ImagePullPolicy = corev1.PullIfNotPresent
	obj.NodeRegistration.ImagePullSerial = ptr.To(true)
	obj.Patches = nil
	obj.DryRun = false
	kubeadm.SetDefaultTimeouts(&obj.Timeouts)
}

func fuzzNodeRegistration(obj *kubeadm.NodeRegistrationOptions, c fuzz.Continue) {
	c.FuzzNoCustom(obj)

        // There are finer grained version requirements, but we don't need to worry about them here, as we use latest patch versions
        if (javaVersion.isCompatibleWith(JavaVersion.VERSION_1_9)) {
            // All latest patches of 2.13 work on Java 9+
            // 2.12 in theory supports it, but doesn't actually take it as a -target so we can't use it
            return VersionCoverage.versionsAtLeast(SCALA_2, "2.13.0")
        }

		Short: "Upgrade the kubelet configuration for this node",
		Long:  kubeletConfigLongDesc,
		Run:   runKubeletConfigPhase(),
		InheritFlags: []string{
			options.DryRun,
			options.KubeconfigPath,
			options.Patches,
		},
	}
	return phase
}

func runKubeletConfigPhase() func(c workflow.RunData) error {
	return func(c workflow.RunData) error {
		data, ok := c.(Data)
		if !ok {

		Run:   runControlPlane(),
		InheritFlags: []string{
			options.DryRun,
			options.KubeconfigPath,
			options.CertificateRenewal,
			options.EtcdUpgrade,
			options.Patches,
		},
	}
	return phase
}

func runControlPlane() func(c workflow.RunData) error {
	return func(c workflow.RunData) error {
		data, ok := c.(Data)
		if !ok {

			options.FileDiscovery,
			options.TokenDiscovery,
			options.TokenDiscoveryCAHash,
			options.TokenDiscoverySkipCAHash,
			options.TLSBootstrapToken,
			options.TokenStr,
			options.CertificateKey,
			options.Patches,
			options.DryRun,
		}
	case "download-certs":
		flags = []string{
			options.CfgPath,
			options.ControlPlane,
			options.FileDiscovery,
			options.TokenDiscovery,
			options.TokenDiscoveryCAHash,