kind: DaemonSet
metadata:
  name: kube-network-policies
  namespace: kube-system
  labels:
    tier: node
    app: kube-network-policies
    k8s-app: kube-network-policies
    addonmanager.kubernetes.io/mode: Reconcile
spec:
  selector:
    matchLabels:
      app: kube-network-policies
  template:
    metadata:
      labels:
        tier: node
        app: kube-network-policies
        k8s-app: kube-network-policies

		signers: signers,
	}
	c.queue = controllers.NewQueue("csr",
		controllers.WithReconciler(c.Reconcile),
		controllers.WithMaxAttempts(5))
	c.csrs.AddEventHandler(controllers.ObjectHandler(c.queue.AddObject))
	return c
}

func (s *Signer) Reconcile(key types.NamespacedName) error {
	csr := s.csrs.Get(key.Name, key.Namespace)
	if csr == nil {
		// CSR was deleted, no action needed

---
apiVersion: apps/v1
kind: DaemonSet
metadata:
  labels:
    addonmanager.kubernetes.io/mode: Reconcile
    k8s-app: konnectivity-agent
  namespace: kube-system
  name: konnectivity-agent
spec:
  selector:
    matchLabels:
      k8s-app: konnectivity-agent
  updateStrategy:
    type: RollingUpdate
  template:
    metadata:
      labels:
        k8s-app: konnectivity-agent
    spec:

	cache.FlushObjectCaches()
	reconciler, err := helmreconciler.NewHelmReconciler(client, kubeClient, iop, &helmreconciler.Options{DryRun: opts.DryRun, Log: l})
	if err != nil {
		l.LogAndError(err)
		return err
	}
	ms := name.Manifest{
		Name:    componentName,
		Content: manifestStr,
	}
	_, err = reconciler.ApplyManifest(ms)
	return err
}

 - Support extra `--prune-whitelist` resources in kube-addon-manager.
 - Update kubectl to v1.10.7.

### Version 8.6  (Tue February 20 2018 Zihong Zheng <******@****.***>)
 - Allow reconcile/ensure loop to work with resource under non-kube-system namespace.
 - Update kubectl to v1.9.3.

### Version 8.4  (Thu November 30 2017 zou nengren @zouyee)
 - Update kubectl to v1.8.4.

	p.webhooks.AddEventHandler(controllers.ObjectHandler(p.queue.AddObject))

	return p, nil
}

func newWebhookPatcherQueue(reconciler controllers.ReconcilerFn) controllers.Queue {
	return controllers.NewQueue("webhook patcher",
		controllers.WithReconciler(reconciler),
		// Try first few(5) retries quickly so that we can detect true conflicts by multiple Istiod instances fast.

    install.operator.istio.io/owning-resource: unknown
    install.operator.istio.io/owning-resource-namespace: istio-system
    istio.io/rev: 1-16
    operator.istio.io/component: Pilot
    operator.istio.io/managed: Reconcile
    operator.istio.io/version: 1.16-alpha.91e471de3e8fc93ebb545cedf396ddbd550b996c
    release: istio
  name: istio-sidecar-injector-1-16
webhooks:
  - admissionReviewVersions:
      - v1beta1
      - v1

	}
	cl := &fakeClientWrapper{fake.NewClientBuilder().WithRuntimeObjects(obj).Build()}
	h, err := helmreconciler.NewHelmReconciler(cl, nil, nil, nil)
	if err != nil {
		return 0
	}
	_ = h.ApplyObject(obj)
	_, _ = h.Reconcile()
	_, _ = h.ApplyManifest(m)
	return 1

		autoServiceExportOptions: opts,
		client:                   opts.Client,
		mcsSupported:             true,
	}
	c.queue = controllers.NewQueue("auto export",
		controllers.WithReconciler(c.Reconcile),
		controllers.WithMaxAttempts(5))

	c.services = kclient.NewFiltered[*v1.Service](opts.Client, kubetypes.Filter{ObjectFilter: opts.Client.ObjectFilter()})

# cluster/saltbase/salt/kube-proxy/kube-proxy.manifest

apiVersion: apps/v1
kind: DaemonSet
metadata:
  labels:
    k8s-app: kube-proxy
    addonmanager.kubernetes.io/mode: Reconcile
  name: kube-proxy
  namespace: kube-system
spec:
  selector:
    matchLabels:
      k8s-app: kube-proxy
  updateStrategy:
    type: RollingUpdate
    rollingUpdate:
      maxUnavailable: 10%